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We address the problem of belief change in (nonmonotonic) logic programming under answer 
set semantics. Unlike previous approaches to belief change in logic programming, our formal 
techniques are analogous to those of distance-based belief revision in propositional logic. In 
developing our results, we build upon the model theory of logic programs furnished by SE models. 
Since SE models provide a formal, monotonic characterisation of logic programs, we can adapt 
techniques from the area of belief revision to belief change in logic programs. 

We first consider belief revision: given logic programs P and Q, the goal is to determine a 
program R that corresponds to the revision of P by Q, denoted P * Q. We investigate several 
specific operators, including (logic program) expansion and two revision operators based on the 
distance between the SE models of logic programs. It proves to be the case that expansion is 
an interesting operator in its own right, unlike in classical AGM-style belief revision where it 
is relatively uninteresting. Expansion and revision are shown to satisfy a suite of interesting 
properties; in particular, our revision operators satisfy the majority of the AGM postulates for 
revision. 

Second, we consider approaches for merging logic programs. Given logic programs Pi, ... , P n , 
the goal is to provide characterisations of the merging of these programs. Again, our formal 
techniques are based on notions of relative distance between the underlying SE models of the logic 
programs. Two approaches are examined. The first informally selects those models of the programs 
that vary the least from the models of the other programs. The second approach informally selects 
those models of a program Pq that are closest to the models of programs Pi, ... , P n . In this case, 
Po can be thought of as analogous to a set of database integrity constraints. We examine properties 
of these operators with regards to how they satisfy relevant postulate sets. 

We also present encodings for computing the revision as well as the merging of logic programs 
within the same logic programming framework, giving rise to a direct implementation of our 
approach in terms of off-the-shelf answer set solvers. These encodings reflect in turn the fact that 
our change operators do not increase the complexity of the base formalism. 
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1. INTRODUCTION 

Answer set programming (ASP) [Gelfond and Lifschitz 1988; Baral 2003] has emerged 
as a major area of research in knowledge representation and reasoning (KRR). On the 
one hand, ASP has an elegant and conceptually simple theoretical foundation, while on 
the other hand efficient implementations of ASP solvers exist which have been finding 
applications to practical problems. However, as is the case with any large program or body 
of knowledge, a logic program is not a static object in general, but rather it will evolve and 
be subject to change, whether as a result of correcting information in the program, adding 
to the information already present, or in some other fashion modifying the knowledge 
represented in the program. 

Since knowledge is continually evolving and subject to change, there is a need to be able 
to revise logic programs as new information is received. In KRR, the area of belief revision 
[Alchourron et al. 1985; Gardenfors 1988] addresses just such change to a knowledge base. 
In AGM belief revision (named after the aforecited developers of the approach) one has a 
knowledge base K and a formula a, and the issue is how to consistently incorporate ainK 
to obtain a new knowledge base K' . The interesting case is when K U {a} is inconsistent, 
since beliefs have to be dropped from K before a can be consistently added. Hence, a 
fundamental issue concerns how such change should be managed. 

In classical propositional logic, specific belief revision operators have been proposed 
based on the distance between models of a knowledge base and a formula for revision. 
That is, a characterisation of the revision of a knowledge base K by formula a. is to set 
the models of the revised knowledge base K' to be the models of a that are "closest" 
to those of K. Of course the notion of "closest" needs to be pinned down, but natural 
definitions based on the Hamming distance [Dalai 1988] and set containment with regards 
to propositional letters [Satoh 1988] are well known. 

In addition to belief revision (along with the dual notion of belief contraction), a second 
major class of belief change operators addresses the merging of knowledge bases. The 
problem of merging multiple, potentially conflicting bodies of information arises in vari- 
ous different contexts. For example, an agent may receive reports from differing sources 
of knowledge, or from sets of sensors that need to be reconciled. As well, an increasingly 
common phenomenon is that collections of data may need to be combined into a coherent 
whole. In these cases, the problem is that of combining knowledge sets that may be jointly 
inconsistent in order to get a consistent set of merged beliefs. Again, as in belief revision, 
specific operators for merging knowledge bases have been developed based on the distance 
between models of the underlying knowledge bases [Baral et al. 1992; Revesz 1993; Lib- 
eratore and Schaerf 1998; Meyer 2001; Konieczny and Pino Perez 2002; Konieczny et al. 
2002]. 
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It is natural then to consider belief change in the context of logic programs. Indeed, there 
has been substantial effort in developing approaches to so-called logic program updating 
under answer set semantics (we discuss previous work in the next section). Unfortunately, 
given the nonmonotonic nature of answer set programs, the problem of change in logic 
programs has appeared to be intrinsically more difficult than in a monotonic setting. In 
this paper, our goal is to reformulate belief change in logic programs in a manner anal- 
ogous to belief change in classical propositional logic, and to investigate specific belief 
revision and merging operators for extended logic programs. Central for our approach are 
SE models [Turner 2003], which are semantic structures characterising strong equivalence 
between programs [Lifschitz et al. 2001]. This particular kind of equivalence plays a major 
role for different problems in logic programming — in particular, in program simplifications 
and modularisation. This is due to the fact that strong equivalence gives rise to a substitu- 
tion principle in the sense that, for all programs P, Q, the programs PUR and QUR have 
the same answer sets, for any program R. As is well known, ordinary equivalence between 
programs (which holds if two programs have the same answer sets) does not yield a substi- 
tution principle. Hence, strong equivalence can be seen as the logic programming analogue 
of ordinary equivalence in classical logic. The important aspect of strong equivalence is 
that it coincides with equivalence in a specific monotonic logic, the logic of here and there 
(HT), which is intermediate between intuitionistic logic and classical logic. As shown by 
Turner [2003], equivalence between programs in HT corresponds in turn to equality be- 
tween sets of SE models. Details on these concepts are given in the next section; the key 
point is that logic programs can be expressed in terms of a non-classical but monotonic 
logic, and it is this point that we exploit here. 

More specifically, given this monotonic characterisation (via sets of SE models) of 
strong equivalence, we adapt techniques for belief change in propositional logic to be- 
lief change in logic programs. Hence we come up with specific operators for belief change 
in ASP analogous to operators in propositional logic. We first consider an expansion op- 
erator. In classical logic, the expansion of knowledge base K by formula a amounts to 
the deductive closure of K U {a}. Hence it is not a very interesting operator, serving 
mainly as a tool for expressing concepts in belief revision and its dual, contraction. In 
logic programs however, expansion appears to be a more useful operator, perhaps due to 
the apparent "looser" notion of satisfiability provided by SE models. As well, it has appeal- 
ing properties. We next develop revision operators based on notions of distance between 
SE models, and, following this, merging operators. 

In characterising the merging of logic programs, the central idea is that the SE models 
of the merged program are again those that are in some sense "closest" to the SE models 
of the programs to be merged. However, as with merging knowledge bases expressed in 
classical logic, there is no single preferred notion of distance nor closeness, and conse- 
quently different approaches have been defined for combining sources of information. We 
introduce two merging operators for logic programs under answer set semantics. Both op- 
erators take an arbitrary (multi)set of logic programs as argument. The first operator can 
be regarded an instance of what Liberatore and Schaerf [1998] call arbitration. Basically 
(SE) models are selected from among the SE models of the programs to be merged; in a 
sense this operator is a natural extension of our belief revision operator. The second merg- 
ing operator can be regarded as an instance of the one discussed by Konieczny and Pino 
Perez [2002]. Here, models of a designated program (representing information analogous 
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to database integrity constraints) are selected that are closest to (or perhaps, informally, 
represent the best compromise among) the models of the programs to be merged. 

Notably, in our approaches there is effectively no mention of answer sets; rather defini- 
tions of expansion and revision are given entirely with respect to logic programs. Notably 
too, our operators are syntax independent, which is to say, they are independent of how a 
logic program is expressed; hence, our operators deal with the logical content of a logic 
program. 

Following an introductory background section, we show that there is a ready mapping 
between concepts in belief revision in classical logic and in ASP; this serves to place belief 
revision in ASP firmly in the "standard" belief revision camp. After this we describe in 
Section 3 our approaches to belief expansion and revision in ASP. We then employ these 
techniques in the following section to address the merging of logic programs. In either 
case, we discuss central properties and give complexity results. Then, in Section 5, we 
show how we can in fact express the process of belief change in ASP itself, giving a direct 
way to compute our introduced belief change operators. We conclude with a discussion. 
Proofs of results are contained in an appendix. 

2. BACKGROUND AND FORMAL PRELIMINARIES 

2.1 Answer Set Programming 

2.1.1 Syntax and Semantics. A (generalised) logic program 1 (GLP) over an alphabet 
A is a finite set of rules of the form 

ai; ■ • • ; a m ; ~6 TO +i; . . . ; ~b n <— c n+ i, . . . ,c a , ~d +i, . . . , ~ d p , (1) 

where Oj, bj, Ck, di G A are atoms, for l<i<m<j<n<k<o<l< p. Operators 
';' and ',' express disjunctive and conjunctive connectives. A default literal is an atom a 
or its (default) negation ~a. A rule r as in (1) is called a fact if p = 1, normal if n = 1, 
positive if m — n and o = p, disjunctive if m — n, and an integrity constraint if n = 0, 
yielding an empty disjunction, sometimes denoted by J_ for convenience. Accordingly, a 
program is called disjunctive (or a DLP) if it consists of disjunctive rules only. Likewise, 
a program is normal (resp., positive) iff all rules in it are normal (resp., positive). We 
furthermore define the head and body of a rule, H(r) and B(r), by: 

H(r) = {ai,...,a m ,~6 m+ i,...,~6„} and 

B{r) = {c n+ i,...,c ,~d 0+ i,...,~d p }. 

Moreover, given a set X of literals, we define 

X+ = {a G A I a G X}, 

X~ = {a G A | ~a G X}, and 

~X = {-a a G X n A}. 

For simplicity, we sometimes use a set-based notation, expressing a rule as in (1) as 
H(r)+;~H(r)- ^ B(r) + ,~B(r)~ . 

In what follows, we restrict ourselves to a finite alphabet A. An interpretation is repre- 
sented by the subset of atoms in A that are true in the interpretation. A (classical) model 

1 Such programs were first considered by Lifschitz and Woo [1992] and called generalised disjunctive logic 
programs by Inoue and Sakama [1998]. 
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of a program P is an interpretation in which all of the rules in P are true according to the 
standard definition of truth in propositional logic, and where default negation is treated as 
classical negation. By Mod(P) we denote the set of all classical models of P. An answer 
set Y of a program P is a subset-minimal model of 

{H(r)+ <- B(r)+ | r G P, H(r)~ C Y, B{r)~ n Y = 0}. 

The set of all answer sets of a program P is denoted by AS(P). For example, the program 

P = {a <— , c:d^a, ^b} has answer sets AS(P) = {{a, c}, {a, d}}. 

2. 1 .2 SE Models. As defined by Turner [2003], an SE interpretation is a pair (X, Y) 
of interpretations such that X CY C A. An SE interpretation is an SZs model of a program 
P if Y \= P and X \= P Y . The set of all SE models of a program P is denoted by 5P(P). 
Note that Y is an answer set of P iff (Y, Y) 6 SP(P) and no {X, Y) G SP(P) with 
X C F exists. Also, we have (F, F) G SP(P) iff Y 6 Mod(P). 

A program P is satisfiable just if SE(P) ^ 0. Two programs P and Q are strongly 
equivalent, symbolically P = s Q, iff SE(P) = SE(Q). Alternatively, P = s Q holds 
iff ^^(P U R) = AS(Q U R), for every program P [Lifschitz et al. 2001]. We also 
write P \= s Q iff SE(P) C SE(Q). For simplicity, we often drop set-notation within SE 
interpretations and simply write, e.g., (a, a&) instead of ({a}, {a, 6}). 

One feature of SE models is that they contain "more information" than answer sets, 
which makes them an appealing candidate for problems where programs are examined 
with respect to further extension (in fact, this is what strong equivalence is about). We 
illustrate this issue with the following well-known example, involving programs 

P = { P ;q^} and Q = { ^ ~p } " 

Here, we have AS(P) = AS(Q) — {{p}, {<?}}• However, the SE models (we list them 
for A = {p, q}) differ: 

SE(P) = {(p,p), (q,q), (p,pq), (q,pq), (pq,pq)}; 
SE(Q) = {(p,p), (q, q), (p,pq), (q,pq), (pq,pq), (9,pq)}. 

This is to be expected, since P and Q behave differently with respect to program extension 
(and thus are not strongly equivalent). Consider R = {p <— q, q <— p}. Then ^4S'(PUP) = 
{{p, q}}, while AS(Q U R) has no answer set. 

A set S of SE interpretations is well-defined if, for each (X, Y) G S, also (Y, Y) G S. A 
well-defined set S of SE interpretations is complete if, for each (X, Y) G S, also (X, Z) G 
S, for any 7C2 with (Z, Z) G S. We have the following properties: 

—For each GLP P, SE(P) is well-defined. 
—For each DLP P, SE(P) is complete. 

Furthermore, for each well-defined set S of SE interpretations, there exists a GLP P such 
that SE(P) = S, and for each complete set S of SE interpretations, there exists a DLP P 
such that SE(P) = S. Programs meeting these conditions can be constructed thus [Eiter 
et al. 2005; Cabalar and Ferraris 2007]: In case S is a well-defined set of SE interpretations 
over a (finite) alphabet A, define P by adding 

(1) the rule r Y ■ ± <- Y, ~{A \ Y), for each (Y, Y) £ S, and 
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(2) the rule r x ,Y ■ (Y\X); ~Y <— X, ~(A \ Y), for each X C Y such that (X, Y) £ S 
and (y.yj'e 5". 

In case 5 is complete, define P by adding 

(1) the rule ry, for each (Y, Y) £ S, as above, and 

(2) the rule r' x Y : (Y \ X) «- X, ~{A \ Y), for each X CY such that (X, Y) £ S and 
(Y,Y)eS. 

We call the resulting programs canonical. 
For illustration, consider 

s = {(p,p), (q,q), (p,pq), (q,pq), (pq,pq), (0,p)} 

over A — {p, q}- Note that S is not complete. The canonical GLP is as follows: 

r : J_ < p,~q; 

r ii, q : q;~q < p; 

H, pq ■■ p; q; ~p; ~q <- • 

For obtaining a complete set, we have to add (9,pq) to S. Then, the canonical DLP is as 
follows: 

r<& ■ -L <- ~p,~q; 
r$, q ■ q < p. 

We conclude this subsection by introducing definitions for ordering SE models that will 
be needed when we come to define our belief change operators. Let denote the symmet- 
ric difference operator between sets, i.e., X QY = (X \ Y) U (Y \ X) for every set X, Y. 
We extend so that it is defined for ordered pairs, as follows: 

Definition 1 . For every pair (X 1 ,X 2 ), (Yi , Y 2 ), 

(x 1 ,x 2 ) e (Yi, y 2 ) = (x 1 Q Y 1 ,x 2 eY 2 ). 

Similarly, we define a notion of set containment, suitable for ordered pairs, as follows: 

Definition 2. For every pair (X 1 ,X 2 ), (Yi,Y 2 ), 

(XuXi) C (Y u Y 2 ) iffX 2 C y 2 , W ; /X 2 = Y 2 then x 1 c y. 

Furthermore, {X U X 2 ) C (Yi, F 2 ) iff(X u X 2 ) C (y lf y 2 ) Wnof (Yi, Y 2 ) C (Xi,X 2 ). 

As will be seen, these definitions are appropriate for SE interpretations, as they give pref- 
erence to the second element of a SE interpretation. 

Set cardinality is denoted as usual by | • |. We define a cardinality-based ordering over 
ordered pairs of sets as follows: 

Definition 3. For every pair (Xi,X 2 ), (Yi,Y 2 ), 

\(X U X 2 )\ < \(Y u Y 2 )\iff\X 2 \ < \Y 2 \andif\X 2 \ = \Y 2 \ then \X X \ < \Yi\. 

Furthermore, \{X U X 2 )\ < \(Y U Y 2 )\ iff \(X U X 2 )\ < \(Y U Y 2 )\ and not \{Y U Y 2 )| < 
l(^i,^2)|. 

As with Definition 2, this definition gives preference to the second element of an ordered 
pair. It can be observed that the definition yields a total preorder over ordered pairs. In the 
next section we return to the suitability of this definition, once our revision operators have 
been presented. 
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2.2 Belief Change 

2.2.1 Belief Revision. The best known and, indeed, seminal work in belief revision 
is the AGM approach [Alchourron et al. 1985; Gardenfors 1988], in which standards for 
belief revision and contraction functions are given. In the revision of a knowledge base 
if by a formula cp, the intent is that the resulting knowledge contains (p, be consistent (un- 
less is not), while keeping whatever information from K can be "reasonably" retained. 
Belief contraction is a dual notion, in which information is removed from a knowledge 
base; given that it is of limited interest with respect to our approach, we do not consider 
it further. Moreover, it is generally accepted that a contraction function can be obtained 
from a revision function by the so-called Harper identity, and the reverse obtained via the 
Levi identity; see Gardenfors [1988] for details. In the AGM approach it is assumed that 
a knowledge base is receiving information concerning a static 2 domain. Belief states are 
modelled by logically closed sets of sentences, called belief sets. A belief set is a set K of 
sentences which satisfies the constraint 

if K logically entails f3, then (3 e K. 

K can be seen as a partial theory of the world. For belief set K and formula a, K + a is 
the deductive closure of K U {a}, called the expansion of K by a. K± is the inconsistent 
belief set (i.e., K± is the set of all formulas). 

Subsequently, Katsuno and Mendelzon [1992] reformulated the AGM approach so that 
a knowledge base was represented by a formula in some language C The following pos- 
tulates comprise Katsuno and Mendelzon's reformulation of the AGM revision postulates, 
where * is a function from £ x C to C: 

(Rl). 

(R2). If ip A yu is satisfiable, then ip * <-> ip A \i. 

(R3). If jU is satisfiable, then ip * \i is also satisfiable. 

(-R4). If ipi <-» tp 2 and Ati <-> fj, 2 , then ipi * \i x <-> ^2 * M2- 

(.R5). (tp * /z) A (p h V * (A* A <t>). 

(R6). If (ip * n) A <p is satisfiable, then ip * (fi A <p) h (ip * n) A (p. 

Thus, revision is successful (Rl), and corresponds to conjunction when the knowledge 
base and formula for revision are jointly consistent (R2). Revision leads to inconsistency 
only when the formula for revision is unsatisfiable (R3). Revision is also independent of 
syntactic representation (R4). Last, (R5) and (R6) express that revision by a conjunction 
is the same as revision by a conjunct conjoined with the other conjunct, when the result is 
satisfiable. 

2.2.2 Specific Belief Revision Operators. In classical belief change, the revision of a 
knowledge base represented by formula ip by a formula \i, ip * fi, is a formula <p> such that 
the models of <p are just those models of /j, that are "closest" to those of ip. There are 
two main specific approaches to distance-based revision. Both are related to the Hamming 
distance between two interpretations, that is on the set of atoms on which the interpretations 



2 Note that "static" does not imply "with no mention of time". For example, one could have information in a 
knowledge base about the state of the world at different points in time, and revise information at these points in 
time. 
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disagree. The first, by Satoh [1988], is based on set containment. The second, due to Dalai 
[1988], uses a distance measure based on the number of atoms with differing truth values 
in two interpretations. A set containment-based approach seems more appropriate in the 
context of ASP, since answer sets are defined in terms of subset-minimal interpretations. 
Hence, we focus on the method of Satoh [1988], although we also consider Dalai-style 
revision, since it has some technical interest with respect to ASP revision. 

The Satoh revision operator, ip * s p,, is defined as follows. For formulas a and (3, define 
Q min {a,P) as 

min<z{{w w' \ w G Mod(a),w' G Mod(/3)}). 

Furthermore, define Mod(tp * s /ti) as 

{w G Mod(p) | 3w'eMod(tP) s.t. w w' G Q min (tp, ft)}. 

The cardinality-based or Dalai revision operator, ip *d A*, is defined as follows. For 
formulas a and (3, define 1 0| mm (a, (3) as 

min<({\wQw'\ | w G Mod(a),w' G Mod(f3)}). 

Then, Mod(ip *d p) is given as 

{w G Mod(fi) | 3w'eMod{ip) s.t. \wQw'\ = \e\ mln {ip , A*)} ■ 

2.2.3 Belief Merging. Earlier work on merging operators includes approaches by Baral 
et al. [1992] and Revesz [1993]. The former authors propose various theory merging op- 
erators based on the selection of maximum consistent subsets in the union of the belief 
bases. The latter proposes an "arbitration" operator (see below) that, intuitively, selects 
from among the models of the belief sets being merged. Lin and Mendelzon [1999] exam- 
ine majority merging, in which, if a plurality of knowledge bases hold <p to be true, then <p 
is true in the merging. Liberatore and Schaerf [1998] address arbitration in general, while 
Konieczny and Pino Perez [2002] consider a general approach in which merging takes 
place with respect to a set of global constraints, or formulas that must hold in the merging. 
We examine these latter two approaches in detail below. 

Konieczny et al. [2002] describe a very general framework in which a family of merg- 
ing operators is parametrised by a distance between interpretations and aggregating func- 
tions. More or less concurrently, Meyer [2001] proposed a general approach to formulating 
merging functions based on ordinal conditional functions [Spohn 1988]. Booth [2002] also 
considers the problem of an agent merging information from different sources, via what is 
called social contraction. Last, much work has been carried out in merging possibilistic 
knowledge bases; we mention here, e.g., the method by Benferhat et al. [2003]. 

We next describe the approaches by Liberatore and Schaerf [1998] and by Konieczny 
and Pino Perez [2002], since we use the intuitions underlying these approaches as the 
basis for our merging technique. First, Liberatore and Schaerf [1998] consider merging 
two belief bases built on the intuition that models of the merged bases should be taken 
from those of each belief base closest to the other. This is called an arbitration operator 
(Konieczny and Pino Perez [2002] call it a commutative revision operator). They consider 
a propositional language over a finite set of atoms; consequently their merging operator 
can be expressed as a binary operator on formulas. The following postulates characterise 
this operator: 

DEFINITION 4. o is an arbitration operator ifo satisfies the following postulates. 
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(LSI). aof3 = (3oa. 

(LS2). a A (3 implies a o (3. 

(LS3). If a A (3 is satisfiable then ao (3 implies a A (3. 

(LSA). ao (3 is unsatisfiable iff a is unsatisfiable and (3 is unsatisfiable. 

(LSS). If a.\ = a-i and f3\ = (3 2 then a\0 (3\ = a 2 o j3 2 . 



{ (ao/?i) V (aoft). 
(LS7). (a o (3) implies (a V (3). 

(LS8). If a is satisfiable then a A (a o (3) is satisfiable. 

The first postulate asserts that merging is commutative, while the next two assert that, for 
mutually consistent formulas, merging corresponds to their conjunction. (LSS) ensures 
that the operator is independent of syntax, while (LS6) provides a "factoring" postulate, 
analogous to a similar factoring result in (AGM-style) belief revision and contraction. Pos- 
tulate (LSI) can be taken as distinguishing o from other such operators; it asserts that 
the result of merging implies the disjunction of the original formulas. The last postulate 
informally constrains the result of merging so that each operator "contributes to" (i.e., is 
consistent with) the final result. 

Next, Konieczny and Pino Perez [2002] consider the problem of merging possibly 
contradictory belief bases. To this end, they consider finite multisets of the form = 
{Ki, . . . , K n }. They assume that the belief sets Ki are consistent and finitely repre- 
sentable, and so representable by a formula. K n is the multiset consisting of n copies 
of K. Following Konieczny and Pino Perez [2002], let A^(^) denote the result of merg- 
ing the multiset ^ of belief bases given the entailment-based integrity constraint expressed 
by ii. The intent is that A^^) is the belief base closest to the belief multiset ty. They 
provide the following set of postulates (multiset union is denoted by U): 

DEFINITION 5. Let ^ be a multiset of sets of formulas, and <ft, \i formulas (all possibly 
subscripted or primed). Then, A is an IC merging operator ;/ it satisfies the following 



(ICO). A^(*) h/i. 

(/CI). //> \f _L then A^(*) \f _L. 

(IC2). //A & \f -I/J, then A^(#) = A * A fi. 

(ICS). = * 2 and m = fi 2 then A w (*i) = A^ 2 (* 2 ). 

(JC4). If<t> h (j, and ft h fj, then A^(4> U <j)') A 4> \f J_ implies A»(<j) U </>') A <j)' \f _L. 
(ICS). A%)AA''(f 2 )hA''(f 1 Uf2). 

(ICQ). //A^^i) A A^(* 2 ) \f Lthen A^(*i U <J/ 2 ) \~ A^(*i) A A^(* 2 ). 
(IC7). Aw(f) A/i 2 h A^ lA ^ 2 (*). 

(IC8). If A 111 (*) A yL«2 1/ -L then A^ A ^ (*) h A w (*) A fi 2 . 

(IC2) states that, when consistent, the result of merging is simply the conjunction of the 
belief bases and integrity constraints. (ICA) asserts that when two belief bases disagree, 
merging does not give preference to one of them. (ICS) states that a model of two merg- 
ings is in the union of their merging. With (ICS) we get that if two mergings are consistent 




or 



or 



postulates. 
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then their merging is implied by their conjunction. Note that merging operators are triv- 
ially commutative. (IC7) and (IC8) correspond to the extended AGM postulates (K * 7) 
and (K * 8) for revision (cf. [Alchourron et al. 1985; Gardenfors 1988]), but with respect 
to the integrity constraints. 

2.3 Belief Change in Logic Programming 

Most previous work on belief change for logic programs goes under the title of update [Foo 
and Zhang 1997; Przymusinski and Turner 1997; Zhang and Foo 1998; Alferes et al. 1998; 
2000; Leite 2003; Inoue and Sakama 1999; Eiter et al. 2002; Zacarias et al. 2005; Del- 
grande et al. 2007]. Strictly speaking, however, such approaches generally do not address 
"update," at least insofar as the term is understood in the belief revision community. There, 
update refers to a belief change in response to a change in the world being modelled [Kat- 
suno and Mendelzon 1992]; this notion of change is not taken into account in the above- 
cited work. A common feature of most update approaches is to consider a sequence Pi, 
Pi, . . . , P„ of programs where each Pi is a logic program. For Pi, Pj, and i > j, the intu- 
ition is that Pi has higher priority or precedence. Given such a sequence, a set of answer 
sets is determined that in some sense respects the ordering. This may be done by trans- 
lating the sequence into a single logic program that contains an encoding of the priorities, 
or by treating the sequence as a prioritised logic program, or by some other appropriate 
method. The net result, one way or another, is to obtain a set of answer sets from such a 
program sequence, and not a single new program expressed in the language of the origi- 
nal logic programs. Hence, these approaches fall outside the general AGM belief revision 
paradigm. 

However, various principles have been proposed for such approaches to logic program 
update. In particular, Eiter et al. [2002] consider the question of what principles the up- 
date of logic programs should satisfy. This is done by re-interpreting different AGM-style 
postulates for revising or updating classic knowledge bases, as well as introducing new 
principles. Among the latter, let us note the following: 

Initialisation. * P = P. 

Idempotency. (P * P) = P. 

Tautology. If Q is tautologous, then P * Q = P. 

Absorption. If Q = R, then ((P * Q) * R) = (P * Q). 

Augmentation. If Q C R, then ((P * Q) * R) = (P * R). 

In view of the failure of several of the discussed postulates in the approach of Eiter et al. 
[2002] (as well as in others), Osorio and Cuevas [2007] noted that for re-interpreting the 
standard AGM postulates in the context of logic programs, the logic underlying strong 
equivalence should be adopted. Since Osorio and Cuevas [2007] studied programs with 
strong negation, this led them to consider the logic N 2 , an extension of HT by allowing 
strong negation. 3 They also introduced a new principle, which they called weak indepen- 
dence of syntax (WIS), which they proposed any update operator should satisfy: 

WIS. If Q = s R, then (P * Q) = (P * R). 



3 N2 itself traces back to an extension of intuitionistic logic with strong negation, first studied by Nelson [ 1 949] . 
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Indeed, following this spirit, the above absorption and augmentation principles can be 
accordingly changed by replacing their antecedents by "Q = s R" and "Q \= s R", respec- 
tively. We note that the WIS principle was also discussed in an update approach based on 
abductive programs [Zacarias et al. 2005]. 

Turning our attention to the few works on revision of logic programs, early work in this 
direction includes a series of investigations dealing with restoring consistency for programs 
possessing no answer sets (cf., e.g., Witteveen et al. [1994]). Other work uses logic pro- 
grams under a variant of the stable semantics to specify database revision, i.e., the revision 
of knowledge bases given as sets of atomic facts [Marek and Truszczyhski 1998]. Finally, 
an approach following the spirit of AGM revision is discussed by Kudo and Murai [2004]. 
In their work, they deal with the question of constructing revisions of form P * A, where 
P is an extended logic program and A is a conjunction of literals. They give a procedural 
algorithm to construct the revised programs; however no properties are analysed. 

With respect to merging logic programs, we have already mentioned updating logic pro- 
grams, which can also be considered as prioritised logic program merging. With respect 
to combining logic programs, Baral et al. [1991] describe an algorithm for combining a 
set of normal, stratified logic programs in which the union of the programs is also strat- 
ified. In their approach the combination is carried out so that a set of global integrity 
constraints, which is satisfied by individual programs, is also satisfied by the combination. 
Buccafurri and Gottlob [2002] present an interesting approach whereby rules in a given 
program encode desires for a corresponding agent. A predicate okay indicates that an atom 
is acceptable to an agent. Answer sets of these compromise logic programs represent ac- 
ceptable compromises between agents. While it is shown that the joint fixpoints of such 
logic programs can be computed as answer sets, and complexity results are presented, the 
approach is not analysed from the standpoint of properties of merging. Sakama and Inoue 
[2008] address what they call the generous and rigorous coordination of logic programs in 
which, given a pair of programs Pi and P2, a program Q is found whose answer sets are 
equal to the union of the answer sets of Pi and P 2 in the first case, and their intersection 
in the second. As the authors note, this approach and its goals are distinct from program 
merging. 

3. BELIEF CHANGE IN ASP BASED ON SE MODELS 

In AGM belief change, an agent's beliefs may be abstractly characterised in various differ- 
ent ways. In the classical AGM approach an agent's beliefs are given by a belief set, i.e., a 
deductively-closed set of sentences. As well, an agent's beliefs may also be characterised 
abstractly by a set of interpretations or possible worlds; these would correspond to models 
of the agent's beliefs. Last, as proposed in the Katsuno-Mendelzon formulation, and given 
the assumption of a finite language, an agent's beliefs can be specified by a formula. Given 
a finite language, it is straightforward to translate between these representations. 

In ASP, there are notions analogous to the above for specifying an agent's beliefs. 
Though we do not get into it here, the notion of strong equivalence of logic programs 
can be employed to define a (logic program) belief set. Indeed, a set of well-defined SE 
models characterises a class of equivalent logic programs. Hence, the set of SE models of 
a program can be considered as the proposition expressed by the program. Continuing this 
analogy, a specific logic program can be considered to correspond to a formula or set of 
formulas in classical logic. 
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3.1 Expanding Logic Programs 

Belief expansion is a belief change operator that is much more basic than revision or con- 
traction, and in a certain sense is prior to revision and contraction (since in the AGM 
approach revision and contraction postulates make reference to expansion). Hence, it is of 
interest to examine expansion from the point of view of logic programs. As well, it proves 
to be the case that expansion in logic programs is of interest in its own right. 

The next definition corresponds model-theoretically with the usual definition of expan- 
sion in AGM belief change. 

DEFINITION 6 . For logic programs P and Q, define the expansion of P and Q, P + Q, 
to be a logic program R such that SE(R) = SE(P) n SE{Q). 

For illustration, consider the following examples: 4 

(1) {p <^-} + {_L <— p] has no SE models. 



Belief expansion has desirable properties. The following all follow straightforwardly 
from the definition of expansion with respect to SE models. 

THEOREM 1 . Let P and Q be logic programs. Then: 

(1) P + Q is a logic program. 

(2) P + Q\= S P. 

(3) IfP \= s Q, then P + Q= S P. 

(4) IfP \= s Q, then P + R \= s Q + R. 

(5) If SE(P) and SE(Q) are well-defined, then so is SE(P + Q). 

(6) IfSE(P) and SE(Q) are complete, then so is SE(P + Q). 

(7) IfQ = s 0, then P + Q = s P. 

While these results are indeed elementary, following as they do from the monotonicity 
of the SE interpretations framework, they are still of interest. Notably, virtually every 
previous approach to updating logic programs has trouble with the last property, expressing 
a tautology postulate. Here, expansion by a tautologous program presents no problem, 



4 Unless otherwise noted, we assume that the language of discourse in each example consists of just the atoms 
mentioned. 



(2) {p <- q} + {_L <- p} has SE model (0, 0). 

(3) {p ^} + {q^- p} = s {p ^} + {q ^} = s {p <-, q «-}■ 

(4) {p<-~g} + { g< -~p} ^ s l^ZZl}- 
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as it corresponds to an intersection with the set of all SE interpretations. We note also 
that the other principles mentioned earlier — initialisation, idempotency, absorption, and 
augmentation — are trivially satisfied by expansion. 

In classical logic, the expansion of two formulas can be given in terms of the intersection 
of their models. It should be clear from the preceding that the appropriate notion of the 
set of "models" of a logic program is given by a set of SE models, and not by a set of 
answer sets. Hence, there is no natural notion of expansion that is given in terms of answer 
sets. For instance, in Example 3, we have AS({p <— }) = {{p}} and AS({q <— p}) = 
{0} while AS({p <—,q <— p]) = {{p,q}}. Likewise, in Example 4, the intersection 
of AS({{p <— ~q}}) = {{p}} and AS({{q <— ~p}}) = {{q}} is empty, whereas 
AS({p^~q, q^~p}) = {{p},{q}}. 

3.2 Revising Logic Programs 

We next turn to specific operators for belief revision. As discussed earlier, for a revision 
P*Q, we suggest that the most natural distance-based notion of revision for logic programs 
uses set containment as the appropriate means of relating SE interpretations. Hence, we 
begin by considering set-containment based revision. Thus, P * Q will be a logic program 
whose SE models are a subset of the SE models of Q, comprising just those models of 
Q that are closest to those of P. Following the development of this operator we also 
consider cardinality-based revision, as a point of contrast. While these two approaches 
correspond to the two best-known ways of incorporating distance based revision, they are 
not exhaustive and any other reasonable notion of distance could also be employed. 

3.2.1 Set- Containment Based Revision. The following definition gives, for sets of in- 
terpretations Ei, E 2 , the subset of Ei that is closest to E 2 , where the notion of "closest" 
is given in terms of symmetric difference. 

DEFINITION 7. Let E\, E 2 be two sets of either classical or SE interpretations. Then: 

a(Ei,E 2 ) = {A G Ei | 3B G E 2 such that 

VA' G E U VB' G E 2 ,A'QB' £ A Q B}. 

It might seem that we could now define the SE models of P * Q to be given by 
a(SE(Q), SE(P)). However, for our revision operator to be meaningful, it must also 
produce a well-defined set of SE models. Unfortunately, Definition 7 does not preserve 
well-definedness. For an example, consider P = {_L <— p] and Q — {p <— Then, 
SE(P) = {(0,0)} and SE{Q) = {(0,p), (p,p)}, and so a(SE(Q), SE(P)) = {(0,p)}. 
However {(0,p)} is not well-defined. 

The problem is that for programs P and Q, there may be an SE model (X, Y) of Q 
with X c Y such that (X,Y) G a(SE(Q), SE(P)) but (Y,Y) g a(SE(Q), SE(P)). 
Hence, in defining P * Q in terms of a(SE(Q), SE(P)), we must elaborate the set 
a(SE(Q), SE(P)) in some fashion to obtain a well-defined set of SE models. 

In view of this, our approach is based on the following idea to obtain a well-defined set 
of models of P * Q based on the notion of distance given in a: 

(1) Determine the "closest" models of Q to P of form (Y, Y). 

(2) Determine the "closest" models of Q to P limited to models (X, Y) of Q where (Y, Y) 
was found in the first step. 
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Thus, we give preference to potential answer sets, in the form of models (Y, Y), and then 
to general models. 

DEFINITION 8. For logic programs P and Q, define the revision of P by Q, P * Q, to 
be a logic program such that: 

ifSE(P) = 0, then SE(P * Q) = SE(Q); 

otherwise 

SE(P*Q) = {(X,Y) | Y G a(Mod(Q),Mod(P)),X C Y, 

and if X <ZY then (X, Y) G o(SE(Q), SE(P))}. 

As is apparent, SE(P * Q) is well-defined, and thus is representable through a canonical 
logic program. Furthermore, over classical models, the definition of revision reduces to 
that of containment-based revision in propositional logic [Satoh 1988]. As we show below, 
the result of revising P by Q is identical to that of expanding P by Q whenever P and Q 
possess common SE models. Hence, all previous examples of non-empty expansions are 
also valid program revisions. We have the following examples of revision that do not 
reduce to expansion. 5 

(1) {p < p} * {_L <- p} = s {_L <- p}. 

Over the language {p, q}, J_ <— p has SE models (0, 0), (0, q), and (q, q). 

<Mr}* {1 -» -{!:.}• 

The first program has a single SE model, (pq,pq), while the second has three, (0, 0), 
(0,p), and (p,p). Among the latter, (p,p) has the least pairwise symmetric difference 
to (pq,pq). The program induced by the singleton set {(p,p)} of SE models is 

{p <-, JL <- q}. 

Thus, if one originally believes that p and q are true, and revises by the fact that one is 
false, then the result is that precisely one of p, q is true. 

Observe that the classical models in the programs here are exactly the same as above. 
This example shows that the use of SE models provides finer "granularity" compared 
to using classical models of programs together with known revision techniques. 

We next rephrase the Katsuno-Mendelzon postulates for belief revision. Here, * is a 
function from ordered pairs of logic programs to logic programs. 

(RA1). P*Q^ S Q. 

(RA2). If P + Q is satisfiable, then P*Q= S P + Q. 
(RA3). If Q is satisfiable, then P * Q is satisfiable. 



5 Note that {p <— ~p} has SE models but no answer sets. 
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{RAA). If Pi = s P 2 and Q x = s Q 2 , then P x * Q, = s P 2 * Q 2 . 
(RA5). (P*Q) + R^ S P*(Q + R). 

(RA6). If (P * Q) + R is satisfiable, then P * (Q + R) \= s (P * Q) + R. 

We obtain that logic program revision as given in Definition 8 satisfies the first five of 
the revision postulates. Unsurprisingly, this is analogous to set-containment based revision 
in propositional logic. 

THEOREM 2. The logic program revision operator * from Definition 8 satisfies postu- 
lates (RA1)-(RA5). 

The fact that our revision operator does not satisfy (RA6) can be seen by the following 
example: Consider 

P = {p; ~p, q <- P, r <- p, s <- p, ±< p, q, 

_L < p,r, _L < p,s}, 

Q = {p;r, -L<-q, ±<-p,r, ± <- p, s, s; ~s <- r}, 
^ = {p; r, -1 <- g, ± <- p, r, _L <- p, s, s <- r}. 
Straightforward computations show that 

SE(P *(Q + R)) = {(rs,rs),(p,p)} while 
SE((P*Q) + R) = {(p,p)}. 

So, P * (Q + R) y= s (P * Q) + R. Since SE((P * Q) + R) ^ 0, this shows that (RA6) 
indeed fails. 

Last, we have the following result concerning other principles for updating logic pro- 
grams listed earlier: 

THEOREM 3. Let P and Q be logic programs. Then, P * Q satisfies initialisation, 
idempotency, tautology, and absorption with respect to strong equivalence. 

Augmentation, however, does not hold, nor would one expect it to hold in a distance- 
based approach. For example, consider the case where P, Q, and R are characterised by 
models SE(P) = {(a, a), (ab, ab)}, SE(Q) = {(ab, ab), (ac, ac), (6, b)}, and SE(R) = 
{(ac, ac), (6, b)}. Thus SE(R) C SE(Q). We obtain that SE(P * Q) = SE(P + Q) = 
{(ab,ab)}, and thus SE{{P*Q)*R) = {(6,6)}. However, SE(P*R) = {{ac, ac), (6,6)}, 
contradicting augmentation. 

Definition 8 seems to be the most natural possibility for constructing a set-containment 
based revision operator. However, it is not the only such possibility. We next briefly 
discuss an alternative definition for revision. The idea here is that for the revision of P by 
Q, we select the closest models of Q to P, and then add interpretations to make the result 
well-defined. 

DEFINITION 9. For logic programs P and Q, define the weak revision of P by Q to be 
a logic program P * w Q such that: 

ifSE{P) = 0, then SE{P * w Q) = SE{Q); 

otherwise 

SE{P * w Q) = a{SE{Q), SE{P)) U 

{{Y,Y) | {X,Y) £ a{SE{Q), SE{P)) for some X}. 
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The drawback to this approach is that it introduces possibly irrelevant interpretations in 
order to obtain well-definedness. As well, Definition 8 appears to be the more natural. 
Consider the following example, which also serves to distinguish Definition 8 from Defi- 
nition 9. Let 

P = {±^p, ±<-q, ±^r}, 
Q = {r, P^q, P< q }■ 

Then, we get the following SE models: 

SE(P) = {(0,0)}, 

SE(Q) = { (r, pqr) , (pr, pr) , (pr, pqr) , (pqr, pqr) } , 

and 

SE(P*Q) = {(pr,pr)}, 
SE(P * w Q) = SE(Q) \ {(pr,pqr)}. 

Consequently, P * Q is given by the program {p, J_ <— q,r}. Thus, in this example, P * Q 
gives the desired result, preserving the falsity of q from P, while incorporating the truth of 
r and p from Q. This then reflects the assumption of minimal change to the program being 
revised, in this case P. P * w Q on the other hand represents a very cautious approach to 
program revision. 

Finally, we have that our definition of revision is strictly stronger than the alternative 
given by * w : 

THEOREM 4. Let P and Q be programs. Then, P * Q \= s P * w Q. 

For completeness, let us mention that enforcing well-definedness by simply determining 
the "closest" models of Q to P of form (Y, Y) is inadequate. For our motivating example, 
we would obtain SE({p <— ^p} * {_L <— p}) = 0, violating the key postulate (RA3), that 
the result of revising by a satisfiable program results in a satisfiable revision. 

3.2.2 Cardinality-Based Revision. We next briefly recapitulate the previous develop- 
ment but in terms of cardinality-based revision. Define, for two sets E\, £2 of interpreta- 
tions, the subset of E\ that is closest to E 2 , where the notion of "closest" is now given in 
terms of cardinality: 

DEFINITION 10. Let E\, E 2 be two sets of either classical or SE interpretations. Then: 

(j\\{Ei,E 2 ) = {A e Ei I 3B e E 2 such that 

MA' e E\,MB' e E 2 , \A' B'\ ft \A Q B\}. 

As with set containment-based revision, we must ensure that our operator results in a 
well-defined set of SE models. Again, we first give preference to potential answer sets, in 
the form of models (Y, Y), and then to general models. 

DEFINITION 1 1 . For logic programs P and Q, define the (cardinality-based) revision 
of P by Q, P * c Q, to be a logic program such that: 

ifSE(P) = 0, then SE(P * c Q) = SE{Q); 
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otherwise 

SE(P* C Q) = {(X,Y) | Y e a l] (Mod(Q),Mod(P)),X C Y, 

and if X C Y then (X, Y) G a\\ (SE(Q), SE(P))}. 

P * C Q can be seen to be well-defined, and so can be represented through a canonical logic 
program. As well, over classical, propositional models the definition reduces to cardinality- 
based revision in propositional logic [Dalai 1988]. 
We observe from the respective definitions that 

SE(P* C Q) C SE(P*Q). 

That the two revision operators differ is easily shown: For example, if 

(p <-] (p; i - } 

P=lq^ \ and Q=i r \ 
[r <- J [ J 

we get S£(P) = {(pgr,pgr)} and SE(Q) = {(p,p), {qr,qr)}. This yields SE(P*Q) = 
{(P,P), (qr, qr)} while SE(P * C Q) = {(qr,qr)}. 

It can be observed that P * c Q yields the same results as P * Q for the five examples 
given in the previous subsection. However, cardinality-based revision fully aligns with the 
AGM postulates: 

THEOREM 5. Let P and Q be logic programs. Then, P* C Q satisfies postulates (RA1) 
- (RAG). 

As well, the following result is straightforward: 

THEOREM 6. Let P and Q be logic programs. Then, P * c Q satisfies initialisation, 
idempotency, tautology, and absorption with respect to strong equivalence. 

3.2.3 Remarks. Both of our proposed approaches to revising logic programs are based 
on a notion of distance between SE models. In the first, a partial preorder was induced 
between SE models, while in the second a total preorder resulted. We note that any def- 
inition of distance that results in a partial (resp., total) preorder among SE models could 
have been used, with the same technical results obtaining (but not, of course, the same 
examples). Hence, these approaches are exemplars of the two most common types of re- 
vision, expressed in terms of differences among truth values of atoms in models. As such, 
our specific approaches can be seen as natural generalisations of the approaches of Satoh 
[1988] and Dalai [1988]. 

We have suggested earlier that the approach based on set containment is the more natural 
or plausible approach, even though it does not satisfy all of the AGM postulates. This 
is because the cardinality-based approach may make somewhat arbitrary distinctions in 
arriving at a total preorder over SE interpretations. Recall the example we used to illustrate 
the difference between the approaches: 

SE(P) ={{pqr,pqr)} and SE(Q) = {(p,p), (qr, qr)}, 

yielding 

SE(P*Q) = {(p,p),(qr,qr)} and SE(P * c Q) = {(qr,qr)}. 

ACM Transactions on Computational Logic, Vol. V, No. N, Month 20YY. 



18 • James Delgrandeet al. 



Given that we have no information concerning the ontological import of the atoms in- 
volved, it seems somewhat arbitrary to decide (in the case of * c ) that qr should take priority 
over p. As an alternative argument, consider where for some large n we have 

SE(P) = {(pi . . .p2n-.Pi ■ ■ -P2n)} and 

SE(Q) = {{pi . . .p n +l,Pl ■ .-Pn+l), (Pi ■ ■■Pn,P\ ■ ■ ■ Pn)} ■ 

So, in this example it is quite arbitrary to select (as the cardinality-based approach does) 

(pi . ..p n +l,Pl ■ ■ -Pn+l) OVer (pi . . .p n ,Pl ■ ■ -Pn)- 

Let us finally remark that another plausible definition of an ordering underlying 
cardinality-based revision would be the following: 

\(X U X 2 )\ <' |(F 1 ,y 2 )|iff |A"i| < |yi|and|X 2 | < \Y 2 \. 

However, this ordering yields a partial preorder, and a revision operator based on this 
notion of distance would be very similar to P * Q; in particular the postulate (RA6) would 
not be satisfied. Since this operator is of at best marginal interest, we do not explore it 
further. 

3.3 Complexity of Revision 

We now turn to the complexity of our approach to revision. First, we recapitulate the 
complexity classes relevant in what follows. As usual, for any complexity class C, by 
co-C we understand the class of all problems which are complementary to the problems 
in C. Furthermore, for C as before and complexity class A, the notation C A stands for 
the relativised version of C, consisting of all problems which can be decided by Turing 
machines of the same sort and time bound as in C, only that the machines have access to 
an oracle for problems in A. 

Four complexity classes are relevant here, viz. NP, Ef , nf , and 6f , which are defined 
thus: 

— NP consists of all decision problems which can be solved with a nondeterministic Turing 
machine working in polynomial time; 

— Ef = NP NP ; 

— nf = co-Ef; and 

— Q>2 is tne class of all problems solvable on a deterministic Turing machine in polynomial 
time asking on input x a total of 0(log \x\) many oracle calls to NP (thus, 0^ is also 
denoted by P NP P°s™]). 

Observe that NP, Ef , and Ilf are part of the polynomial hierarchy, which is given by 
the following sequence of objects: the initial elements are 

A p - T p - TT P - P- 

and, for i > 0, 

Af = P s » P -i ; Ef = NP E -i ; nf = co-NP s -i . 

Here, P is the class of all problems solvable on a deterministic Turing machine in poly- 
nomial time. It holds that Ef = NP, Ef = NP NP , and nf = co-NP NP . A problem is 
said to be at the k-th level of the polynomial hierarchy iff it is in Af +1 and either Ef -hard 
or nf -hard. 
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We first consider the worst-case complexity of our approach to set-containment based 
revision. The standard decision problem for revision in classical logic is: 

Given formulas P, Q, and R, does P * Q entail Rl 

Eiter and Gottlob [1992] showed that approaches to classical propositional revision are 
nf-complete. The next result shows that this property carries over to our approach for 
program revision. 

THEOREM 7. Deciding whether P * Q ^ s R holds, for given GLPs P, Q, and R, 
is Ilf -complete. Moreover, hardness holds already for P being a set of facts, Q being 
positive or normal, and R being a single fact. 

Although we do not show it here, we mention that the same results holds for the cautious 
revision operator *„, as well. 

For cardinality-based revision, we obtain the following result, again mirroring a simi- 
lar behaviour for the classical case and being a consequence of the construction given in 
Section 5: 

THEOREM 8. Deciding whether P * c Q \= s R holds, for given GLPs P, Q, and R, is 
in ®2- 

4. MERGING LOGIC PROGRAMS 

We denote (generalised) logic programs by Pi, P2, . . . , reserving Pq for a program rep- 
resenting global constraints, as described later. For logic programs Pi, P2, we define 
Pi n P 2 to be a program with SE models equal to SE(P 1 ) n SE(P 2 ) and P 1 U P 2 to be 
a program with SE models equal to SE(Pi) U SE(P 2 ). By a belief profile, we under- 
stand a sequence 6 (Pi, . . . , P n ) of (generalised) logic programs. For ^> = (Pi, . . . , P n ) 
we write n\& for Pi l~l • • • n P n . We write vPi o <3/ 2 for the (sequence) concatenation 
of belief profiles ^ 2 ; and for logic program P and * = (Pi, . . . , P n ) we abuse 
notation by writing (P , for (P , Pi, ... , P„). A belief profile <]/ is satisfiable just 
if each component logic program is satisfiable. The set of SE models of is given by 
= SE(Pi) x ••• x SE(P n ). ForSG SE(^>) such that S= (Si, . . . , S n ), we use 
Si to denote the i th component of S. Thus, Si G SE(Pi). Analogously, the set of classical 
propositional models of is given by Mod(^) = Mod(Pi) x • • • x Mod(P n ); also we 
use Xi to denote the i th component of X e Mod(^>). 

4.1 Arbitration Merging 

For the first approach to merging, called arbitration, we consider models of ^ and select 
those models in which, in a global sense, the constituent models vary minimally. The result 
of arbitration is a logic program made up of SE models from each of these minimally- 
varying tuples. Note that, in particular, if a set of programs is jointly consistent, then there 
are models of ^> in which all constituent SE models are the same. That is, the models that 
vary minimally are those S G SE^) in which Si — Sj for every 1 < i, j < n; and 
merging is the same as simply taking the union of the programs. 

The first definition provides a notion of distance between models of vp, while the second 
then defines merging in terms of this distance. 



This departs from usual practise, where a belief profile is usually taken to be a multiset. 
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Table I. Examples on Arbitration Merging. 



Pi 


P 2 


5E(V((Pi,P 2 ») 


V«Pi,P 2 » 


{p-} 


{<?<-} 


{(P<3,P<?)} 


{p <- , 9 ^} 


{p-} 


{-P} 


{(p,p),(0,0)} 


{p; ~p ^} 


{p < — p} 


{-P} 


{(0,p),(p,p),(0,0)} 


{} 


{P <- ,9 ^} 


{<- P,<?} 


{(p<?,p<?), ip,p), (q, q)} 


{p; 9 <-, p; ~p <-, g; ~9 <-} 


{± +— ~p , _L <— ~g} 


{^P,<?} 


{SeSE(<S) | 5^ (0,0)} 


{-L < f>,~<2} 


{±<-p,±<- ? } 


{p;<? ^} 


{(0,0), (p,p), (<?,«)} 


{<- p,<?, p;~p <?;~<2 ^} 



DEFINITION 12. Lef * = (Pi , . . . , P„) fee a satisfiable belief profile and let ~S, T be 
two SE models of ^ (or two classical models of^J). 

Then, define S < a T, if Si Q Sj C T, Q Tjfor every 1 < i < j < n. 

Clearly, < a is a partial preorder. In what follows, let Min a (N) denote the set of all minimal 
elements of a set N of tuples relative to < a , i.e., 

Min a (N) = (S G N | T < a S implies S < a T for all T G N} . 

Preparatory for our central definition to arbitration merging, we furthermore define, for 
a set AT of n-tuples, 

UN = {Si | for Se N, S= (Si,...,S n ) and i G {l,...,n}}. 

DEFINITION 13. Let * = (Pi, . . . , P n ) be a belief profile. Then, the arbitration merg- 
ing, or simply arbitration, of^f, is a logic program V(*) such that 

5B(V(*)) - | Y G UMin a (Morf(*)),X C Y, 

and if X dY then (X, Y) G UMin a (SE(V))} , 

providing ^> is satisfiable, otherwise, if Pi is unsatisfiable for some 1 < i < n, define 
V(*) = V«Pi,... ) Pi-i,P i+ i,...,P n ». 

For illustration, consider the belief profile 

(Pi,P2) = ({p^,u^},{<-p,v<-}). (2) 

Since SE(P\) = {(pu,pu),(pu,puv),(puv,puv)} and SE(P 2 ) = {(v, v), (v, uv), 
(uv, uv)}, we obtain nine SE models for SE((P\, P 2 )). Among them, we find a unique 
< a -minimal one, yielding Min a (SE((Pi, P2))) = {((puv , puv) , (uv , uv))} . Simi- 
larly, (Pi,P 2 ) has a single < a -minimal collection of pairs of classical models, viz. 
Min a (Mod((Pi, P2))) = {(pui>, uv)}. Accordingly, we get 

UMin a (Mod((P 1 ,P 2 ))) = {puv,uv}, 
UMin a (SE((P 1 ,P 2 ))) = {(puv, puv), (uv,uv)}, and 
SE(W((P 1 ,P 2 ))) = UMm (^((P 1 ,P 2 ))). 

We thus obtain the program V((Pi,P2)) = {p;~p <— , u <— , v ^} as the resultant 
arbitration of Pi and P 2 . 

For further illustration, consider the technical examples given in Table I. 

We note that merging normal programs often leads to disjunctive or generalised pro- 
grams. Although plausible, this is also unavoidable because merging does not preserve the 
model intersection property of the reduced program satisfied by normal programs. 
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Moreover, we have the following general result. 

THEOREM 9. Let * = (Pi,P 2 ) be a belief profile, and define Pi o P 2 = V(*). Then, 
o satisfies the following versions of the postulates of Definition 4. 

(LSI'). P 1 oP 2 = s P 2 oP 1 . 
(LS2'). P 1 HP 2 K PioP 2 . 

(LS3'). If Pi n P 2 is satisfiable then Pi o P 2 \= s P 1 n P 2 . 
(LSA 1 ). Pi o P 2 is satisfiable iff Pi is satisfiable and P 2 is satisfiable. 
(LS5'). If Pi = s P 2 and P[ = s P^ then P x o P 2 = s P{oP^. 
(LST). P 1 oP 2 KPiUP, 

(LS8 1 ). If Pi and P 2 are satisfiable then Pi n (Pi o P 2 ) is satisfiable. 
4.2 Basic Merging 

For the second approach to merging, programs Pi , . . . , P„ are merged with a target logic 
program P so that the SE models in the merging will be drawn from models of P . This 
operator will be referred to as the (basic) merging of Pi, . . . , P n with respect to p). The 
information in P must hold in the merging, and so can be taken as necessarily holding. 
Konieczny and Pino Perez [2002] call P a set of integrity constraints, though this usage 
of the term differs from its usage in logic programs. Note that in the case where SE(Pq) 
is the set of all SE models, the two approaches (of this section and the previous section) do 
not coincide, and that merging is generally a weaker operator than arbitration. 

Definition 14. Let * = (P , . . . , P n ) be a belief profile and let S, T be two SE 
models of^ (or two classical models o/\T/). 

Then, define S < b T, if S Q Sj C T 9 Tj for every 1 < j < n. 

As in the case of arbitration merging, <b is a partial preorder. Accordingly, let Minb(N) be 
the set of all minimal elements of a set N of tuples relative to < b . In extending our notation 
for referring to components of tuples, we furthermore define N — {S | S G N}. We 
thus can state our definition for basic merging as follows: 

DEFINITION 15. Let v& = (Pi, ... , P„) be a belief profile. Then, the basic merging, or 
simply merging, of^b, is a logic program A(4 r ) such that 

£E(A(tf)) = {{X,Y) | Y e Mm b (Mod(y)) a ,X C Y, 

and if X C Y then (X,Y) G Mm b (SE(^)) } , 

providing ^ is satisfiable, otherwise, if Pi is unsatisfiable for some 1 < i < n, define 
A(*) = A((P ,...,P_i,P+i,...,P„}). 

Let us reconsider Programs Pi and P 2 from (2) in the context of basic merging. To this 
end, we consider the belief profile (0, {p 4— , u <— }, {+— p , v <— }). We are now faced 
with 27 SE models for SE (((!), Pi,P 2 )). Among them, we get the following <fc-minimal 
SE models 

Min b (SE((% 1 Pi,P 2 ))) = {((uv,uv), (puv,puv), (uv,uv)), 

{(uv 7 puv), (puv,puv), (uv, uv)), {(puv 7 puv) 7 (puv,puv), (uv, uv))} 
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Table II. Examples on Basic Merging. 



1 P1 


Pi 


5E(A((0,P 1 ,P 2 ») 


{p-} 


{««-} 


{(P9,P<?)} 


{p-} 


{-P} 


{(P,p),(0,0)}u{(p,0)} 


{p < — p} 


{«- P} 


{(0,p),(p,p),(0,0)} 


{p «- ,<? ^} 


{^P,<?} 


{(P9:P<?): (p,p), (<?,<?)} U {(p, pg), (5,2*2)} 


— <?} 


{^P,<?} 


{S e SE(0) | 5^ (0,0)} 




{p; <? ^} 


{(0,0),(p,p),(5,5)}U{( P ,0) ) (5,0)} 



along with Minb(Mod{{$, Pi, P2))) = {{uv,puv 7 uv), (puv,puv 7 uv)}. We get: 

Min b {Mod(($,P 1 ,P 2 )))o = {puv,uv}, 
Mirn,{SE{($,Pi,P<2)))o = {(uv,uv),(uv,puv),(puv,puv)}, and 
5B(A«0,Pi,P 2 ))) = Min b (SE((^,P 1 ,P 2 ))) . 

While arbitration resulted in V((Pi, P 2 )) = {p; <— , « <— , v <—}, the more conserva- 
tive approach of basic merging yields A((0, Pi, P 2 )) = {u <— , v <— }. 

We have just seen that basic merging adds "intermediate" SE models, viz. (uv,puv), to 
the ones obtained in arbitration merging. This can also be observed on the examples given 
in Table I, where every second merging is weakened by the addition of such intermediate 
SE models. This is made precise in Theorem 11 below. We summarise the results in 
Table II but omit the programs A( (0, Pi , P 2 ) ) because they are obtained from V( (Pi , P 2 ) ) 
in Table I by simply dropping all rules of form p; ^p <— and q; <— , respectively. 

The next example further illustrates the difference between arbitration and basic merg- 
ing. Take Pi = {p <— ,q ^} and P 2 = {^p <— , ~q <— }. Then, we have that 
5B(V«Pi,P 2 ») = {(w,P</),(0,0)} and S£(A((0, Pi, P 2 ») = SE(0). That is, in 
terms of programs, we obtain 

V((Pi,P 2 )) = {p;~p^, q:~q^, ^ P ,~q, <- ~p,q} and A((0, Pi, P 2 ))=0. 

THEOREM 10. Let ^ be a belief profile, P$ a program representing global constraints, 
and A as given in Definition 15. Then, A satisfies the following versions of the postulates 
of Definition 5: 

(ICO'). A«P ,*» K^o- 

(/CI'). If Pq and "J/ are satisfiable then A((Po, ^)) is satisfiable. 
(IC2'). //n(P , *) is satisfiable then A((P , *)) = s P n (n(tf)). 
(ICS'). IfP = s P(J and * = s *' f/zen A((P , *)) = s A((P^ *')). 
(JC4'). If Pi K p o WP 2 hs Po then: 

ifA((P ,Pi,P 2 )) n Pi is satisfiable, then A((P , Pi, P 2 )) n P 2 is satisfiable. 

(JC5'). A((P ,*))nA((P ,*'» K A«P , *<>*'))■ 
(JCT). A«P ,*»nPi K A((P nPi,*)). 

(JC9'). ief fee a permutation ofty. 77*en, A((P , #)) = s A((P , *'}). 

We also obtain that arbitration merging is stronger than (basic) merging in the case of 
tautologous constraints in P . 

THEOREM 11. Let * be a belief profile. ThenV(^) \= s A((0,*)). 
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As well, for belief profile = (Pi, P 2 ), we can express our merging operators in terms of 
the revision operator defined in Section 3.2. 

THEOREM 12. Let (Pi, P 2 ) be a belief profile. 

(1) V((Pi,P 2 » - (Pi * P 2 ) U (P 2 * P). 

(2) A((P 1 ,P 2 » = P 2 *P 1 . 

Note that in the second part of the preceding result, Pi is regarded as a set of constraints 
(usually with name P ) according to our convention for basic merging. 

4.3 Complexity Analysis 

In the previous section, the following decision problem was studied with respect to the 
revision operator *: Given GLPs P, Q, R, does P * Q \= s R hold? This problem was 
shown to be LTf-complete. Accordingly, we give here results for the following problems: 

(1) Given a belief profile and a program R, does V(^) ^ s R hold? 

(2) Given a belief profile ^ and a program R, does A(\f/) \= s R hold? 

By Theorem 12, it can be shown that the hardness result for the revision problem also 
applies to the respective problems in terms of merging. On the other hand, II^ -membership 
can be obtained by a slight extension of the encodings given in the next section such that 
these extensions possess an answer set iff the respective problem (1) or (2) does not hold. 
Since checking whether a program has at least one answer set is a problem on the second 
of layer of the polynomial hierarchy, and our (extended) encodings are polynomial in the 
size of the encoded problems, the desired membership results follow. 

THEOREM 13. Given a belief profiled and a program R, deciding V(\T/) \= s R (resp., 
A(*) \= s R) is Ilf -complete. 

5. COMPUTING BELIEF CHANGE VIA ANSWER SET PROGRAMMING 

In this section, we provide encodings for our belief change operators in terms of fixed non- 
ground ASP programs. We recall that non-ground programs are defined over predicates 
of arbitrary arity which have either variables or constants as arguments. Such non-ground 
programs can be seen as a compact representation of large programs without variables (and 
thus as propositional programs), by considering the grounding of a program (recall that the 
grounding of a program P is given by the union of the groundings of its rules, and the 
grounding of a rule r e Pis the set obtained by all possible substitutions of variables in 
r by constants occurring in P; cf. Dantsin et al. [2001] for a more thorough exposition). 
The non-ground programs we define in this section can be seen as queries which take the 
(propositional) programs subject to revision or merging as an input database. Thus, we 
follow here the tradition of meta-programming (see, e.g., the works of Delgrande et al. 
[2003], Eiter et al. [2003], and Gebser et al. [2008]). 

Our encodings are given via certain language fragments of non-ground ASP such that 
their respective data complexity matches the complexity of the encoded task. Recall that 
data complexity addresses problems over programs PUD where a non-ground program P 
is fixed, while the input database D (a set of ground atoms) is the input of the decision prob- 
lem. As is well known, the data complexity of the problem whether a is contained in all 
answer sets of P U D is fl-f-complete for disjunctive programs (without weak constraints) 
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[Dantsin et al. 2001] and 6^-complete for normal programs with certain optimisation con- 
structs (for instance, weak constraints over a single level; we introduce weak constraints 
later) [Buccafurri et al. 2000]. We use weak constraints for the encoding of the cardinality- 
based revision operator (although similar optimisation constructs could be used likewise) 
while for the set-based revision operator and the merging operators we require disjunctive 
programs. However, instead of coming up with encodings for the decisions problems dis- 
cussed in the previous section, our ultimate goal here is to provide programs such that their 
answer sets characterise the SE models of the result of the encoded revision or merging 
problem. 

Before we start with the ASP encodings, we have to fix how the programs subject to 
revision and merging are represented in our approach. To have a uniform setting in what 
follows, we use belief profiles ^ = (P a , . . . , P n ) where, for revision problems we have 
a = 1 and n = 2 (and so (Pi , P 2 ) here represents revision problem Pi * P 2 ), for arbitration 
problems a = 1 and n > 2, and for basic merging, we use a = and n>2. 

Given such a belief profile ^> = (P a , . . . , P n ), we use four ternary predicates, phead, 
nhead, pbody, and nbody to represent ^. For each predicate, the first argument i indices 
the program (i.e., i is a number between a and n), the second argument contains the rule 
identifier #r of a rule r G Pi, and the third argument is an atom, indicating that this atom 
occurs in the positive or negative head or the positive or negative body of rule r e Pi, 
respectively. For example, let ^ = (P\,P2) with Pi = {<— ^p, <— ^q} and P2 = 
{p; q <— , <— p, q}. We obtain the relational representation ofty by 7 

[*] = {nbody (1, 1, p), nbody(l, 2, q), 

phead(2,l,p), phead(2,l,q), pbody (2,2, p), pbody (2, 2, q)}. 

Here, we just use numbers as rule identifiers, i.e. ~p) = q <— ) = 1 and 

#(<— ~q) = #(<— P, q) = 2. The only necessary requirement is that different rules are 
assigned to different identifiers, i.e., r ^ r' implies #r / #r'. 

In general, we define the relational representation of a belief profile as follows. 

DEFINITION 16. Let * = (P Q , . . . , P n ) be a belief profile. Then, the relational repre- 
sentation ofty is given by 



We assume here that all i and =^r are given as numbers. Note that some ASP solvers 
then require to define the domain of integers (for instance, via #maxint in the solver 
DLV [Leone et al. 2006]). Following datalog notation, we write, for a program n and a 
belief profile <J/, II [W] instead of n U [*]. 

We provide our encodings in a modular way. That is, we introduce various sets of rules 
which implement different aspects required to solve the respective problem. We start with 
some basic modules, which are used in most of the encodings. Then, we provide our results 
for revision and conclude with the encodings for merging. 



n 




i—a r£Pi 



{pbody(i, #r, a) | a G B(r) + } U {nbody (i, #r, a) \ a G B(r) } ) . 



7 Since we have here rales which are all simple facts, we omit the 'W-symbol for rales. 
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5.1 Basic Modules 

We start with a simple fragment which contains some domain predicates and fixes some 
designated identifiers. 

Definition 17. 

^domain = {prog _rule(P, R) <- a(P, R, A) , dom(A) <— a(P, R, A) 
a £ {phead , pbody , nhead, nbody}} U 
{prog(P) <— prog_rule(P, R), 
model(c) *—, model{t) *—, model(h) *—, 
prog jmodel(c) <— , prog _model(t) *—, prog_model(h) <— }. 

Predicates prog.rule(-, •), dom(-), and prog(-) are just used to gather some information 
from a conjoined input [\T/]; the designated constants c, t, h are used later on to distinguish 
between different guesses for models. In fact, c refers to classical models while h and t 
refer to the first and second part of SE models, respectively. 

The following code guesses such models for each program P in the belief profile <1>. The 
guess is accomplished in Rules (3) and (4) below which assign each atom A in the domain 



to be in(-) or out(-). 
Definition 18. 

^models = {in(P,A,M) <- ~out(P,A,M),prog(P),dom(A),model(M), (3) 

out(P, A, M) < in(P, A, M),prog{P), dom(A), model(M), (4) 

<- in(P, A, h), out(P, A, t), (5) 

diff(P, Q, A, M) <- in(P, A, M), out(Q, A, M), (6) 

diff(P, Q, A, M) <- out(P, A, M), in(Q, A, M), (7) 

same(P, Q, A, M) <- m(P, A, M), in(Q, A, M), (8) 

same(P,Q,A,M) <- out(P, A, M), out(Q, A, M), (9) 

ok{P,R,M) <- in(P,A,M),phead(P,R,A),model(M), (10) 

ok(P,R,M) <- out(P,A,M),pbody(P,R,A),model(M), (11) 

ofc(P, i?, M) <- m(P, A, M), nbody{P, R, A), prog .model (M), (12) 
ok(P,R,M) <- out(P,A,M),nhead(P,R,A),prog-model(M), (13) 

ofc(P, P, ft) <- m(P, A, t), nbody(P, R, A), (14) 

ofc(P, P, ft) <- o«f(P, A, i), nhead(P, R, A), (15) 

< ofc(P, P, M), prog_rule(P, R), model (M)}. (16) 



This allows us to draw a one-to-one correspondence between answer sets 5 and models 
(resp., SE models) of the programs P, in the belief profile. Note that Rule (5) excludes 
such guesses where the corresponding SE model (X, Y) would not satisfy X C Y\ To 
make this intuition a bit more precise, let us define the following operator for a set S of 
ground atoms and a number i: 

^Mod(S) = {a | in{i,a,c) £ S}; 
u se( s ) = ({a I in{i,a,h) £ S},{b\ in(i,b,t) £ S}). 
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The next Rules (6) - (9) indicate whether atom A is assigned differently (via predicate 
diff{-, •, •, •)) or equally (via predicate same(-, •, •)) for two programs. These predicates 
are useful later. 

The remaining Rules (10) - (15) tell us which rules (in which programs) are satisfied 
by the respective guess. Observe that (10) and (11) are applied to any forms of models 
(i.e., h, t, and c) while (12) and (13) are only applied to t and c. Rules (14) and (15) 
finally take care of the fact that the first argument of an SE model has to be a model of the 
reduct. Therefore, we check whether the model given by the t-guess already eliminates 
rules. Note that such rules are satisfied by the /i-guess in a trivial way. The last Rule (16) 
finally ensures that all rules of all programs are satisfied by our guesses. 

We observe that the answer sets of the program P[9] where P — it domain U ft models are 
in a one-to-one correspondence to the models and SE models of belief profile Formally 
we have that, given = (P a , . . . , P n ), 

{(M, N) | M e Mod(y),N e SE($)} = 
{((H a Mod (S), . . .,U n Mod (S)), (U a SE (S), n n SE (S))) | S e AS{P[*])}- 

We define one further module, which just orders the domain elements (i.e., the atoms 
in the given belief profile) using the standard ordering < provided by the employed ASP 
solver. In particular, we define infimum, supremum, and successor with respect to this 
order. This is a standard technique used quite frequently in ASP; we require this later in 
order to "loop" over the domain elements. We also note that we could add such rules also 
for the program indices, as well as for the rule identifiers. However, since we assume them 
to be given by successive numbers, we omit such rules here. In fact, we use N = M + 1 
instead of a designated successor predicate for program indices and rule identifiers. We 
add only rules which provide the minimal number a and resp. the maximal number n of 
programs in the given profile ^ = (P a , . . . , P n ). The module thus looks as follows: 

Definition 19. 

ft order = {lt(X,Y) «- dom(X),dom(Y),X < Y, 
nsucc(X, Z) «- lt(X, Y), lt{Y, Z), 
succ(X,Y) «- lt(X,Y),~nsucc(X,Y), 
ninf(X) <- lt(Y,X), 
nsup(X) <- lt(X,Y), 
inf(X) <— ~mn/(X), dom(X), 
sup(X) <— ^nsup(X), dom(X), 
minprog(P) <— prog(P),P = Q + 1, ~prog(Q), 
maxprog(P) <— prog(P), Q = P + 1, ^prog(Q)}. 

5.2 Encodings for Revision 

5.2.1 Cardinality-based Revision. We are now prepared to encode the cardinality- 
based revision, following Definition 1 1 . For our forthcoming encoding, we require optimi- 
sation constructs which are available in most ASP solvers. We shall use here the concept 
of weak constraints [Buccafurri et al. 2000] as used by DLV. A weak constraint (without 
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weights and levels) is a rule of the form 

<=c 1 ,...,c m ,~d m+ i,...,~d p . (17) 

The semantics of a program P with such weak constraints is as follows: First, compute 
the answer sets of the program P' given as P without the weak constraints. Then, count 
for each answer set S of P the number of the grounded weak constraints which apply 
to S. By "apply to S", we mean that given a ground weak constraint of the form (17) 
{ci, . . . , c m } C S and {d m+ i, . . . , d p } n S jointly hold. The answer sets of P are then 
given by those answer sets P' which have a minimal number of applied weak constraints. 

Recall that for representing revision problems, we use belief profiles of the form 
(Pi, P 2 ). We already have computed all models and SE models of both programs. We 
now have to (i) find those pairs (M 1 ,M 2 ) of models Mi € Mod(Pi), M 2 € Mod(P 2 ) 
which have a minimum number of differences, and (ii) find those pairs (Si, S 2 ) of SE 
models Si € Mod(S\), S 2 £ Mod(P 2 ) which are minimal with respect to the order < 
defined in Definition 3. After isolating the respective answer sets we then can find the 
SE models of P\ * c P 2 (following Definition 11) quite straightforwardly. Indeed, Task (i) 
can easily be achieved by making use of weak constraints which penalise each mismatch, 
and a similar method is possible for Task (ii). However, Definition 3 requires a certain 
two-phased comparison of SE models. We thus count a mismatch in the /i-models as many 
times as we have differences in the t and c-models, respectively. Finally, if there was no 
difference in the t- or c-models, we still have to count the number of mismatches in the 
/i-models. This is done by the third rule in the following program. 

Definition 20. 

T^card = {<= diff (1,2, A, M),prog_model{M), 
^ diff (1,2, A, h), diff (1, 2, B,M), 

<= diff {I, 2, A, h),~diff(l, 2, B, M), dom(B), prog .model (M), 
selector(2) <— }. 

We finally put things together. To this end, we first define a module which takes the 
models and SE models, respectively, of some selected program (in the case of revision, it 
is program P 2 , thus selector(2) is specified in n car d) and copies them into a designated 
predicate. 

Definition 21. 

^result — {total <— ^nontotal, 
nontotal <— ^total, 

<— nontotal, selector(S), in(S, A, t), out(S, A, c), 
<— nontotal, selector(S), out(S, A, t), in(S, A, c), 
resultH(A) <— selector(S), in(S,A, h), nontotal, 
resultH(A) <— selector (S), in(S, A, c), total, 
resultT(A) <- selector(S),in(S,A,c)}. 

The intuition for the module is as follows: we either generate a total SE model (Y, Y) or 
a non-total SE model (X, Y) with X C Y. Thus, the guess between predicates total and 
nontotal. In case we want to derive a non-total SE model (X, Y), we have to make sure 
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that Y coincides with the classical model we guessed. This is done by the two constraints. 
The remaining lines fill the predicates resultH and resultT accordingly, where atoms in 
resultH yield the X of the SE model and atoms in resultT yield the Y of the SE model. 
We formulate our first main result. 

THEOREM 14. For any set S of non-ground atoms, let 

p{S) = ({a | resultH{a) G S}, {b \ resultT(b) G S}). 

Moreover, let 

Pcard — ^ domain U 7T m odels U TTresult U 7T card 

and * = (Pi, P2) a belief profile. Then, 

SE(P 1 * c P 2 ) = {p(S) I S G AS(P card [*})}- 

5.2.2 Set-based Revision. We continue with set-based revision. Unfortunately, the en- 
codings now become more cumbersome, since we cannot make use of weak constraints 
anymore (which implicitly compared different models and SE models). Instead, we have 
to use a certain saturation technique (also called spoiling), which is quite common to en- 
code problems from the second level of the polynomial hierarchy [Eiter and Gottlob 1995; 
Eiter and Polleres 2006]. Let us first look at the two main modules for revision it witness 
and TTind : ir witness guesses a witness and contains the so-called "spoiling rules" (explained 
below); this module is also used later in the encodings for merging. TXi nc i contains the spe- 
cific conditions for spoiling in terms the revision operator. Two predicates used in -Kind, 
violated and samediff .all, will be explained in detail later. 

Intuitively, the module ^witness works as follows. For each interpretation guessed in 
^models we now guess possible witnesses via predicates win and wout. Note that this 
guess (see Rule (18) below) is done via disjunction. This allows us to treat wrong guesses 
for witnesses via saturation (rather than via constraints as we did in 7r mo<Ms ). In fact, 
such wrong guesses will be indicated via the predicate spoil {'Kind will provide us with 
rules which derive spoil). Finally, if all such guesses for witnesses are violating some 
properties, we know that our initial guess (via in and out) meets the expected criteria, 
and the constraint <— ~ spoil guarantees that only those initial guesses are contained in the 
answer sets of our encodings. Let us look at this concept in more detail. 

Definition 22. 

^witness 

= {win(P, A, M) ; wout(P,A,M) <— prog (P), dom(A), model (M), (18) 

wdiff(P, Q, A, M) <- win(P, A, M), wout(Q, A, M), (19) 

wdiff(P, Q, A, M) <- wout{P, A, M), win(Q, A, M), (20) 

wsame(P, Q, A, M) <- win(P, A, M), win(Q, A, M), (21) 

wsame(P, Q, A, M) <- wout{P, A, M), wout(Q, A, M), (22) 

notsubseteq{M, I, J) <- same{P, Q, A, M), wdiff(P, Q, A, M), (23) 

win(P, A, M) <- spoil, prog(P), dom(A), model(M), (24) 

8 One might ask why we use the different concepts of t- and c-models. The reason is that there might be a minimal 
difference between (X\ , Y\ ) and (X2 , Y2 ) although there is no minimal difference between Y\ and Y2 . But then 
we still need those interpretations Y in order to compute the corresponding interpretations X. On the other hand, 
there might be a minimal distance between Y\ and Y2 but not between any (Xi , Y\ ) and (X2 , Y2 ) . Still, we 
then want (Yjj, Y2) in the result. 
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wout(P,A,M) <- spoil, prog (P), dom(A), model(M), (25) 
<— ^spoiZ}. (26) 

As mentioned before, Rule (18) formulates the disjunctive guess for witnesses (referred 
to as "wguess" in the following) and Rules (19)-(22) provide us with some auxiliary pred- 
icates in exactly the same spirit as Rules (6)-(9) from tt models- Rule (23) indicates that the 
wguess cannot be in a certain subset relation to the initial guess. 

Let us illustrate this for the case of revision and suppose the initial guess (via in and 
out) talks about models Mi of Pi and M 2 of P 2 and the wguess (via win and wout) talks 
about models Ni of P x and N 2 of P 2 . In case Ni 6 N 2 % M\ Q M 2 , we derive here 
notsubseteq{\, 2, c). 

Before discussing Rules (24)-(26), let us now turn to the specific conditions under which 
predicate spoil is derived: 

Definition 23. 

Kind = {spoil <— win(P,A,h),wout(P,A,t), (27) 

spoil <- violated(P, R, M), (28) 

spoilcond(M) notsubseteq(M, 1,2), prog -model (M), (29) 

spoilcond(c) <— samediff ' _all(c) , (30) 

spoilcond{t) <— notsubseteq(h, 1,2), samediff _aZZ(t), (31) 

spoilcond(t) <— samediff _all(h), samediff _aZZ(t), (32) 

spoiZ <— spoilcond(c), spoilcond(t), (33) 

selector^) <-}. (34) 

Rule (27) mirrors Rule (5) from ~n m odels in order to obtain valid SE interpretations. 
Rule (28) checks whether some wguess does not satisfy some rule (predicate violated is 
defined in program itvioiation below). Both rules derive predicate spoiZ. 

Let us for the moment return to Rules (24) and (25), which derive all possible win and 
wout predicates in case spoil was derived. Thus, in other words, a wguess which violates 
some property has to carry to predicate spoil, but in case spoil is derived all possible 
win and wout predicates have to be derived, hence all these wguesses lead to a single 
answer-set candidate / containing all win and wout predicates (the in and out predicates 
remain unchanged, however, and thus still characterise an initial guess G). In the end, 
we want that to check whether each wguess violates some property (i.e., carries the spoil 
predicate). To guarantee that this is the case, Rule (26) finally kills such interpretations, 
where a wguess would have been valid. Now, due to the minimality of the answer set 
semantics, if such a wguess existed (for an initial guess G), then the set I (containing the 
same initial guess) cannot become an answer set, and this initial guess has to be withdrawn. 
In turn, if no wguess without the spoil predicate is left (for an initial guess G), then the 
saturated interpretation I for this initial guess becomes an answer set. 

So far, we just have eliminated wguesses which violate the concept of being models and 
SE models of the given belief profile, respectively. We now have to take the conditions of 
Definition 8 into account. To this end, we derive spoil for wguesses which are not in the 
desired relation to the initial guess. Let us first look into the classical models and suppose 
the initial guess (via in and out) makes reference about models Mi of Pi and M 2 of 
P 2 and the wguess (via win and wout) refers to models Ni of Pi and N 2 of P 2 . In case 
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NiQN 2 % Mi QM 2 , we already observed that we obtain notsubseteq(l, 2, c) and we have 
one reason to spoil this wguess (cf. Rule (29)). The same holds for N± N 2 — Mi M 2 
(this is done by Rule (30); for the definition of predicate samediff .all, see below). A 
second reason to spoil is if also the initial guess for the SE models Si = (Xi, Yi) of Pi 
and S 2 = (X 2 ,Y 2 ) of P 2 is in a certain relation to the SE model S[ — (X[,Y{) of Pi and 
S' 2 = (X 2 , Y 2 ) of P 2 which are given by the wguess. In accordance to Definition 2, we 
first have to compare the there-parts. Thus, if Y[ Y 2 % Yi Q Y 2 , we already have a reason 
to spoil (again, taken care of by Rule (29)). If Y{ Y 2 = Yi Y 2 , we are not allowed 
to spoil yet, but have to look into the here-parts. Now, we spoil if X[ X' 2 % X\ X 2 
(Rule (31)) or if X[ X' 2 = X 1 X 2 (Rule (32)). If both reasons for spoil are fulfilled, 
we finally derive spoil by Rule (33). Finally, rule selector(2) <— plays the same role as in 
TT card and triggers the Tr resu i t module. 

It remains to define the predicates violated and samediff .all. One particular problem is 
that the employed saturation technique allows only for a restricted use of negation. There- 
fore, we have to re-implement concepts in a different way. In fact, predicates samediff .all 
and violated are obtained via additional predicates which loop over all atoms (we now 
require the concepts defined in module n order)- 

Let us have a closer look on the definition of the violated predicate, which derives 
violated(P, R, M) if the rule R of program P is violated by the current wguess (either in 
terms of o, t-, or ^-models, as explained earlier). The main idea is to loop over all domain 
elements. To this end, we first check whether the current guess potentially violates the rule 
R if we just look at an atom A. For instance, if we consider a rule a <— b, and a is in 
the guess, then this guess cannot violate the rule; the same holds if b is not in the guess. 
In general, these conditions are formulated by the unsat predicate defined below. Next, 
we loop over all atoms, and in case we can violate the rule if we take all domain elements 
B into account (violupto(P, R, B, M)), and A is the next element and also allows for 
violation, we derive violupto(P, R, A, M). rule R is violated by the wguess. 

Definition 24. 

^violation = {unsat(P, R, A, M) <- win(P, A, M),~phead(P, R, A), 

~nbody(P, R, A), prog_rule(P, R), 
prog -model{M) , 
unsat(P, R, A, M) <- wout(P, A, M),~pbody{P, R, A), 
~nhead(P, R, A), progjrule{P, R), 
prog-model(M), 

unsat(P, R, A, h) <— wout(P, A, h), win(P, A, t), ^pbody(P, R, A), 
^nbody{P, R, A), progjrule(P, R), 

unsat{P, R, A, h) <— wout(P, A, h), wout(P, A, t), ~pbody(P, R, A), 
^nhead(P, R, A), prog -rule (P, R), 

violupto(P, R, A, M) <— inf(A), unsat(P, R, A, M), 

violupto(P, R, A, M) <— succ(B, A), violupto(P, R, B, M), 
unsat(P,R,A,M), 

violated{P, R, M) <- sup(A), violupto(P, R, A, M)}. 
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The test for equality follows a similar idea. In fact, what we want to do here is, given two 
sequences of models, (M a , . . . , M n ) and (N a , . . . ,N n ), to check whether Mi Mj — 
Ni Q Nj for all a < i < j < n. The first five rules in the module below do this for any 
pair of indices i, j. By transitivity of =, it is then sufficient to simply loop over all indices 
and check whether the above test holds for all i, j such that a < i < n and j = i + 1. 

Definition 25. 

n eq — {samediff _atom(I , J, A, M) <— same(I, J, A, M), wsame(I, J, A, M), 
samediff. atom(I, J, A, M) <- diff(I, J, A, M), wdiff(I, J, A, M), 
samediff _upto_atom(I , J, A, M) <— inf(A), samediff _atom(I , J, A, M), 
samediff _upto_atom(l J, A, M) <— succ(B, A), samediff _atom(I , J, ^4, M), 

samediff _upto _atom,{I , J, B, M), 
samediff {I, J, M) <— sup(A), samediff -upto-atom(I , J, A, M), 
samediff -upto-prog(I,M) <— minprog(I), 
samediff -upto_prog (I , M) <— I = J + 1, samediff (I , J, M), 

samediff japtojprog ( J, M), 
samediff _all(M) <— samediff _upto-prog(I,M),maxprog(I)}. 
We have the following result. 

THEOREM 15. Let^ = {Pi,P 2 ) a belief profile and define 

Pincl — ^domain U 7T models U border U 7T result U ^witness U T^incl U *K violation U 7T e ^. 

S£(Pi * P 2 ) = {p(S) I S G ^(P inc / [*])}, 
w/zere p z's defined as in Theorem 14. 

5.3 Encodings for Merging 

5.3.1 Z?as/c Merging. We continue with the problem of basic merging. We now sup- 
pose that belief profiles = (Po ,P n ) with an arbitrary number of programs are given. 
Also recall that Po plays a special role in basic merging. In particular, the SE models of 
the result of the merging are taken from the SE models of Po. 

In view of the general definition of the previous modules, we do not need to add any 
further concepts and just define the spoiling conditions: 

Definition 26. 

Kbasic — {spoil <— win(P,A,h),wout(P,A,t), 
spoil <— violated(P, R, M), 

spoilcond(M) <— notsubseteq(M,0, J), prog -model (M), 

spoilcond(c) <— samediff _all(c), 

spoilcond{t) <— notsubseteq(h,0, J), samediff _all(t), 

spoilcond{t) <— samediff _all(h), samediff _all(t), 

spoil <— spoilcond(c), spoilcond(t), 

selector(0) <— , prog(0) <— }. 
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Note that we specified selector(0) to select the program from which n resu i t takes the 
models and SE models to define the results, respectively. Also note the fact prog(0) which 
is necessary in case P$ is the empty program. 

We have the following result: 

THEOREM 16. Let ^ = {Pq, . . . , P n ) a belief profile and define 

Phasic — 7^ domain U ?T models U border U ^result U ^witness U ^violation U TTeq U ^basic- 
Then, 

SE(A(*)) = { P (S) | S e 4S(P 6osic [*])}, 

w/zere p is defined as in Theorem 14. 

5.3.2 Arbitration Merging. Our final encoding is the one for arbitration merging. The 
spoiling module it arbitration given next is very much in the style of tt basic an d ^inci- How- 
ever, we need a somewhat more complicated module to prepare the resultH and result T 
predicates, since arbitration merging collects SE models from all programs of the belief 
profile rather than from a single program (which was the case in the approaches we en- 
coded so far). We thus do not use a selector predicate here but instead provide a new 
result module below. Also recall that belief profiles for arbitration merging are of the form 
(Pi, . . . , P n ). In fact, the only main difference between itbasic and -n arbitration is to check 
that our guess is minimal in a global sense (i.e., the models vary in a minimal way among 
each other, cf. Definition 12) while in the case of basic merging the minimality has been 
guaranteed between the designated program Pq and the other programs (cf. Definition 14). 
This particular difference is reflected by the usage of predicate notsubseteq(-, 1, J) com- 
pared to notsubseteq{-, 0, J) as used in n basic . 

Definition 27. 

K arbitration = {spoil <- win(P, A, h) , WOUt(P, A, t) , 

spoil <— violated(P, R, A, M), 

spoilcond(M) <— notsubseteq(M, I , J), prog_model{M), 
spoilcond{c) <— samediff _all(c) , 

spoilcond{t) <— notsubseteq{h 1 1 , J), samediff _all(t), 
spoilcond(t) <— samediff _all(h) , samediff _all(t) , 
spoil <— spoilcond(c), spoilcond(t), 
win(P, A, M) <— spoil, prog (P), dom(A), model(M), 
wout{P,A,M) <— spoil, prog (P), dom(A), model (M), 
<— <~ spoil}. 

Here is the new result module: 

Definition 28. 

Kesuit = {tout(I); tout(J) <- prog(I),prog(J),I ^ J, 
tselect(I) <— ^tout(I), prog (I), 
total <— r^nontotal, 
nontotal <— ~total, 
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resultT(A) <- in(M,A,c), tselect(M), 
resultH(A) <- in(M, A, c), total, tselect(M), 
hout(I); hout(J) <— prog(I),prog(J),I J, nontotal, 
hselect(I) <— ^hout (I), prog (I), nontotal, 

<— nontotal, in{I, A, t), out(J, A, c), tselect(J), hselect(I), nontotal, 
<— nontotal, out{I , A, t), in( J, A, c), tselect(J), hselect(I), nontotal, 
resultH(A) <— in(I, A, h), hselect(I), nontotal}. 

Roughly speaking, the first two rules select exactly one program Pj from the belief 
profile. We then guess whether we build a total or a non-total SE model (as we did in 
^result)- Then, we copy the model from the guessed program into the there-part of the 
result, and in case we are constructing a total SE model, also in the here-part. If we 
construct a non-total SE model, we guess a second program Pj from the belief profile and 
check whether the there-part of the current SE model of Pj coincides with the classical 
model of Pj (this is done by the two constraints). If this check is passed, we copy the 
here-part of the SE model of Pj into the here-part of the resulting SE model. 

We arrive at our final result: 

THEOREM 17. Let * = (Pi, . . . , P n ) a belief profile and define 

^arbitration — ^domain U ^models U border U 71 ' resu n U 

7t witness U ^violation U 7T e q U 7T arbitration • 

Then, 

SE(V(*)) = {p(S) | S G AS(P incl [*})}, 
where p is defined as in Theorem 14. 

All encodings presented here can be downloaded under the following URL: 

http : / /www . cs . uni-pot sdam .de/~torsten/ 

6. DISCUSSION 

We have addressed the problem of belief change in logic programming under the answer 
set semantics. Our overall approach is based on a monotonic characterisation of logic 
programs, given in terms of the set of SE models of a program. Based on the latter, we first 
defined and examined operators for logic program expansion and revision. Both subset- 
based revision and cardinality-based revision were considered. As well as giving properties 
of these operators, we also considered their complexity. This work is novel, in that it 
addresses belief change in terms familiar to researchers in belief revision: expansion is 
characterised in terms of intersections of models, and revision is characterised in terms of 
minimal distance between models. 

We also addressed the problem of merging logic programs under the answer set seman- 
tics. Again, the approaches are based on a monotonic characterisation of logic programs, 
given in terms of the set of SE models of a sequence of programs. We defined and ex- 
amined two operators for logic program merging, the first following intuitions from arbi- 
tration [Liberatore and Schaerf 1998], the second being closer to IC merging [Konieczny 
and Pino Perez 2002]. Notably, since these merging operators are defined via a semantic 
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characterisation, the results of merging are independent of the particular syntactic expres- 
sion of a logic program. As well as giving properties of these operators, we also considered 
complexity questions. Last, we provided encodings for both program revision and program 
merging. 

We note that previous work on logic program belief change was formulated at the level 
of the individual program, and not in terms of an abstract characterisation (via strong equiv- 
alence or sets of SE interpretations). The net result is that such previous work is generally 
difficult to work with: properties are difficult to come by, and often desirable properties 
(such as the tautology property) are lacking. The main point of departure for the current 
approach then is to lift the problem of logic program revision or merging from the program 
(or syntactic) level to an abstract (or semantic) level. 

A. APPENDIX 

A.1 Proof of Theorem 1 

Most of the parts follow immediately from the fact that SE(P + Q) = SE(P) n SE(Q). 

(1) We need to show that Definition 6 results in a well-defined set of SE models. 

For SE(P) n SE(Q) = we have that is trivially well-defined (and R can be given 
byJ_«-). 

Otherwise, for SE(P) n SE(Q) ^ 0, we have the following: If (X, Y) G SE(P) n 
SE{Q), then (X,Y) e SE(P) and (X,Y) e SE(Q); whence (Y,Y) G SE(P) 
and (Y, Y) G SE(Q) since SE{P) and SE(Q) are well-defined by virtue of P and 
Q being logic programs. Hence, (Y,Y) G SE(P) n SE(Q). Since this holds for 
arbitrary (X, Y) G SE(P) n SE(Q), we have that SE(P) n SE(Q) is well-defined. 

(2) Immediate from the definition of +. 

(3) If P \= s Q, then SE(P) C SE(Q). Hence, SE(P) n SE(Q) = SE(P), or P + Q = s 
P. 

(4) Similar to the previous part. 

(5) This was established in the first part. 

(6) To show completeness, we need to show that for any (X, Y) G SE(P + Q) and 
(Y U Y', Y U Y') G SE(P + Q) that (X, Y U Y') G SE(P + Q). 

If (X,Y) G SE(P + Q) and (Y U Y',Y U Y') G SE(P + Q), then (X,Y) G 
SE(P)nSE(Q) and (YuY',YuY') e SE(P) n SE(Q). Hence, (X,Y) G SE{P) 
and (y U Y' , Y U Y') G SE(P), and so, since S£(P) is complete by assumption, we 
have (X, Y U Y') G 5S(P). 

The same argument gives that (X,Fuy') G 5S(Q), whence (X,FUF') G SE{P)C\ 
SE(Q) and (X, Y U Y') G 5S(P + Q). 

(7) If Q = s 0, then 5P(Q) = {(X, Y) \ X C Y C A} from which the result follows 
immediately. □ 

A.2 Proof of Theorem 2 

(RAl). This postulate follows immediately from Definition 8. Note that (X, Y) G 
SE(P*Q) only if Y G a(Mod(Q), Mod(P)), and therefore (Y, Y) G a(SE(Q), SE(P)). 
So, S£(P * Q) is well-defined. 

(RA2). If P + Q is satisfiable, then we have that both cr(Mod(Q), Mod(P)) ^ 
and a{SE(Q), SE(P)) ^ 0. Further, for Y G Mod(Q) (or (X, Y) G SE(Q)), there is 
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some Y' G Mod(P) (resp., (X', Y') G SE(P)) such that Y Q Y' = (resp., (X, Y) Q 
(X 1 , Y') = 0), from which our result follows. 

(RA3). From Definition 8 we have that, if P is unsatisfiable, then Q is satisfiable iff 
P * Q is satisfiable. 

Otherwise, if P is satisfiable and Q is satisfiable, then there is some (Y, Y) e 
a(Mod(Q), Mod(P)) (since SE{Q) is well-defined and given Definition 7). Hence, 

SE(P * Q) ± 0. 

(RAA). Immediate from Definition 8. 

(RA5). If SE(P) = 0, then the result follows immediately from the first part of Defi- 
nition 8. 

Otherwise, we show that, if (X, Y) is an SE model of (P * Q) + R, then (X, Y) is an 
SE model of P* (Q + R). 

Let (X, Y) G SE((P * Q) + R). Then, (X, Y) G SE(P * Q) and (X, Y) G SE{R). 
Since (X, Y) G SP(P * Q), by (JL41) we have that (X, Y) G S£(Q), and so (X, Y) G 
SE(Q) n SP(P), or (X, Y) G SP(Q + P). 

There are two cases to consider: 
X = Y: Since then (X, Y) = (Y, Y), and (Y, Y) G SP(P * Q), we have that Y G 

a (Mod (Q), Mod (P)). Hence, from Definition 7, Y G Mod(Q) and there is some 

Y' G Mod(P) such that there is no Yi G Mod(Q) and no Y 2 G Mod(P) such that 

Yi e y 2 c y e y. 

We established at the outset that (X, Y) G SE(Q + R). Hence, Y G Mod(Q + R). This 

gives us that Y G Mod(Q + R) and there is some Y' G Mod(P) such that no Yi, Y 2 

exist with Yi G Mod(Q), Y 2 G Mod{P), and Y 9 Y> C Y 9 Y'. 

Clearly, in the above, if there is no Y\ G Mod(Q) such that the above condition holds, 

then there is no Y\ G Mod(Q + R) such that the above condition holds. 

Thus, we have Y G Mod(Q + R) and there is some Y' G Mod(P) for which no 

Yi G Morf(Q + R) and no Y 2 G Mod(P) exists such that Y 1 9 Y 2 C Y 9 Y'. 

Thus, from Definition 7, we get Y G cr(Mod(Q+R), Mod(P)), hence (Y, Y) G 

(Q + i?)). 

X C Y: We have Y G a(Mod(Q), Mod{P)) by virtue of (X, Y) G S£(P * Q). In the 
previous part we established that Y G a(Mod(Q + R), Mod(P)). 
As well, (X, Y) G a{SE(Q), SE{P)) since (X, Y) G SE(P * Q). Thus, from Defini- 
tion 7, we have that there is some (X 1 , Y') G such that no U, V, U', V exist such 
that (U, V) e SE(Q), ([/', V) G S£(P), and (C/, V) 9 (W, V) C (X, Y) 9 (X', Y'). 
Therefore, there is no (U, V) G SE(Q+R) and no ([/', V) G S£(P) such that ([/, V)Q 
{U',V) c (X,Y)9(X',Y'). 

We previously showed that (X, Y) G SE(Q + R). Consequently, from Definition 8, we 
obtain that (X, Y) G a(SE(Q + R), SE(P)). Hence, (X,Y) G SE(P * (Q + R)). 
Thus, in either case, we get (X, Y) G SE(P * (Q + R)), which was to be shown. □ 

A.3 Proof of Theorem 3 

For initialisation, idempotency, and tautology, in the left-hand side of the given equiva- 
lence, revision corresponds with expansion via (RA2), from which the result is immediate. 

For absorption, we have Q — R, and so ((P * Q) * R) = ((P * Q) * Q). Since 
SE(P * Q) C 5P(Q), then from Theorem 1, Part 3, we have that (P * Q) + Q = s P *Q. 
As well, ((P*Q)*Q) = ((P * Q) + Q), from which our result follows. □ 
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A.4 Proof of Theorem 4 

We need to show that SE(P * Q) C SE(P * w Q). If SE(P) = 0, then SE(P * Q) = 
SE(Q) = SE(P * w Q). 

Otherwise, there are two cases to consider: 

(1) (X, Y) G SE{P * Q) where X C Y. Then, {X, Y) G a(SE(P), SE(Q)) by Defini- 
tion 8, and {X, Y) 6 SE(P * w Q) by Definition 9. 

(2) (Y, Y) G SP(P * Q). From Definition 8, we have that Y G o{Mod(Q), Mod(P)). 
Y G <r(Mod{Q), Mod{P)) implies that (Y, Y) G a(SE{Q), SE{P)). Hence, accord- 
ing to Definition 9, (Y, Y) G SP(P *„, Q). 

Therefore, {X, Y) G SE(P * Q) implies that {X, Y) G SE (P * w Q), whence SE(P * 
Q) C SE(P* W Q). □ 

A.5 Proof of Theorem 5 

Before giving the proof, we first present a lemma that is key for postulates (RA5) and 
(iL46). 

LEMMA 1. Let Ei, E 2 , and E 3 be SE interpretations. If <7||(Pi, E 2 ) fl P 3 7^ 0, then 

a n {E 1 ,E 2 )nE 3 = a ll (E 1 nE 3 ,E 2 ). 

Proof. Assume that a\\(Ei, P 2 ) n E 3 ^ 0. 

For showing C in the equality, let (X, Y) e <7|i(Pi, E 2 ) n P 3 and, toward a contradic- 
tion, assume that {X, Y) £ <7|| (Pi n P 3 , P 2 ). 

Since (X,Y) G <7||(Pi,P 2 ), so (X,Y) G Pi; as well, (X,Y) e P 3 , so (X, Y) e 
Pi n P 3 . Since (X, Y) ^ er||(Pi n P3,P2) we have that there is some (X',Y') G 
PiHP 3 and some (U',V) € E 2 such that for every (U, V) G P 2 , \(X', Y')Q {U' , V')\ < 
\(X, Y) e (J7, V)|. But this contradicts the assumption that (X, Y) G <7|| (Pi, E 2 ). Hence, 
the assumption that (X, Y) £ c\\(Ei n P 3 ,P 2 ) cannot hold, i.e., {X, Y) G (T||(Pi n 
P 3 , P 2 ), establishing that (7||(Pi,P 2 ) n P 3 C <7||(Pi n E 3 ,E 2 ). 

To show D in the equality, let (X, Y) G <T|| (Pi n P 3 , P 2 ) and, toward a contradiction, 
assume that (X, Y) £ <7|| (Pi, P 2 ) H P 3 . 

Since (X, Y) G <7||(Pi n P 3 ,P 2 ), we get that (X, Y) G P 3 . Hence, (X, Y) 
(T||(Pi,P 2 ) (via the assumption that {X, Y) ^ <7|| (Pi, P 2 ) n P 3 ). 

We also have by assumption that cr||(Pi,P 2 ) n P 3 ^ 0, and so let (X',Y') G 
iT|| (Pi, P 2 )nP 3 . Then, from the first part above, we have that {X, Y) G cr||(Pi nP 3 , P 2 ). 
Thus, we have both that {X, Y) G cr||(Pi (~1 P 3 , P 2 ) and (X', Y') G o-||(Pi n E 3 ,E 2 ). 
Consequently, we obtain that 

min({\(X,Y) e (C/, Y)| | (17, V) G P 2 }) = mm({|(l',Y) e (£/, V ) | (U, V) G P 2 }). 

Therefore, since (X', Y') G <7||(Pi,P 2 ), so also (X, Y) G CT||(Pi,P 2 ). But this together 
with (X, Y) G P 3 contradicts our assumption that (X, Y) ^ <7m(Pi, P 2 )nP 3 ; i.e., we have 
(X, Y) G (T||(Pi,P 2 ) n P 3 , establishing that ct| 1 (Pi, P 2 ) n P 3 2 0]|(Pi n P 3 ,P 2 ). □ 

We now move on to the proof of Theorem 5: 

(iL41). This follows immediately from Definition 11. Note that (X, Y) G SE(P * c Q) 
only if Y e a\\(Mod(Q), Mod(P)), and therefore (Y, Y) G a\\ (SE(Q), SE(P)). So, 
SP(P * c Q) is well-defined. 
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(RA2). If P + Q is satisfiable, then we have that both a\\(Mod(Q), Mod(P)) / 
and a\\(SE(Q), SE(P)) ^ 0. Further, for Y G Mod(Q) (or (X, Y) G SE(Q)) we have 
that there is some Y' G Mod(P) (resp., (X',Y') e SE(P)) such that Y e Y' = 
((X, y) e (X', Y') = 0), from which our result follows. 

(RA3). From Definition 1 1 we have that, if P is unsatisfiable, then Q is satisfiable iff 
P * Q is satisfiable. Otherwise, if P is satisfiable and Q is satisfiable, then there is some 
(y y) G <7|| (Morf(Q), Mod{P)) (since S£(Q) is well-defined and given Definition 10). 
Hence, SE{P*Q) 0. 

(PA4). This is immediate from Definition 1 1 . 

(iL45), (iL46). For P * c Q, if SP(P) = 0, we have that (P * c Q) + R = Q + R = 
(P* c (Q + R)). 

So, assume that 5P(P) ^ 0. We show that SE(P* C Q) + SE(R) = SE(P* C (Q + R)), 
thus establishing both postulates. 

For C, assume that (X,Y) G SP(P * c Q) + R. Thus, (X, y) G SE(P * c Q) and 
(X,Y) G R. 

For ICF.we have that Y G CT|| (Mod(Q), Mod(P)) and as well y G Mod(R). We 
get that y G <7|| (Mod(Q + P), Mod(Pj) by the analogous proof in propositional logic for 
cardinality-based revision. 

For X C y we have that (X, y) G cr,, (S'P(Q), SP(P)) and as well (X, Y) G SP(P). 
By Lemma 1 we get that (X,Y) G cr\\{SE(Q + R), SE(P)). 

This establishes one direction of the set equality. For D, the argument is essentially the 
same, though in the reverse direction, and again appealing to Lemma 1 . 

A.6 Proof of Theorem 6 

The proof is the same as for Theorem 3. 

A.7 Proof of Theorem 7 

Since we deal with a globally fixed language, we first need a few lemmata. 

LEMMA 2. Let P,Q be programs, Y an interpretation, and x G Y\var(PUQ). Then, 
Y G a(Mod(Q), Mod(P)) implies Y \ {x} G a(Mod{Q), Mod(P)). 

Proof. Since Y G cr(Mod(Q), Mod(P)), so Y G Mod{Q) and there exists some 
Z G Mod(P) such that for each Y' G Mod(Q) and Z' G Mod(P), Y 1 Q Z' (tY Q Z. 
We show that x £ Z holds. Suppose this is not the case: Then, we have x £ Y Q Z, since 
x G y. Now, since .t ^ var(P), also ZU{i}e Mod(P). But then i^ejZU {x}) 
which yields y 6 (Z U {x}) cF0Z,a contradiction to our assumption. Hence, we can 
suppose x e Z. Now, since y € Mod(Q), obviously Y \ {x} G Mod(Q) as well. We 
obtain y e Z = (y \ {x}) 9 (Z \ {a;}), thus Y \ {x} G a{Mod(Q), Mod(P)) holds. □ 

LEMMA 3. Lef P, Q fee programs, (X, Y) an SE interpretation, and x £ Y \ var(P U 
Q). Then, (X,Y) G a(SE(Q), SE(P)) implies (X\{x},Y\{x}) G a(SE(Q), SE(P)). 

PROOF. Since (X,Y) G <r(SE(Q),SE(P)), (X,Y) e SE(Q) and there exists a 
(J7,Z) G SE(P) such that for each (X',y') G S'P(Q) and each (J7',Z') £ SP(P), 
(X',y') e (t7',Z') <£ (X,Y) e We show that the following relations hold: 

(i) x e Z; and (ii) x e U iff x E X. Towards a contradiction, first suppose x Z. Then, 
we have x G Y Z, since x G Y. Now, since a; ^ var(P), also ({/, Z U {x}) G SE(P) 
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and (U U {x},Z U {x}) G SE(P). We have x <£ Y Q (Z U {x}) which yields 
YQ(ZU{x}) CYQZ. Thus, (X,Y)Q(U, ZU{x}) C (X, Y) Q (U, Z), which is a con- 
tradiction to the assumption. Hence, x G Z holds. If (ii) does not hold, we get x G X Q U . 
Now, in case x G X and x £ U, we have {X, Y) Q (U U {x}, Z) C (X, Y) Q (U, Z). 
In case x G U and x £ X, we have (X, F) G (U \ {x}, Z) C (X, F) 9 (f/, Z). Again, 
both cases yield a contradiction. Clearly, (X, Y) G SE(Q) implies (X \ {x}, Y \ {x}) G 
S£(Q) and we obtain {X, Y) Q (U, Z) = (X \ {x}, Y \ {x}) Q (U \ {x}, Z \ {x}). 
(X \ {x}, Y \ {x}) G <r(SE(Q), SE(P)) thus follows. □ 

LEMMA 4. For any programs P, Q, and R, P * Q ^= s R iff there exist X C Y C 
mr(P U Q U J?) smc/z f/zaf (X, F) e SE{P * Q) and (X, Y) £ SE(R). 

Proof. The if-direction is by definition. 

As for the only-if direction, assume P * Q ^= s R. Then, there exists a pair (X, Y) 
such that (X,Y) e 5E(P * Q) and (X,F) ^ 5^(i?). Let V = var{P U Q U fl). 
We first show that (X n V, Y n F) G 5E(P * Q). By definition, (AT,F) G SE(Q). 
If 5P(P) = 0, SE(P * Q) = SE{Q), and since (X,Y) G ^(Q) obviously implies 
(XflV, FnF) G SP(Q), (XnV, FnF) e SE{P*q) thus follows in this case. So suppose 
5P(P) ^ 0. Then, F G a (Mod (Q), Mod (P)). By iteratively applying Lemma 2, we 
obtain that also F n V G a(Mod(Q), Mod(P)). Analogously using Lemma 3, (X, Y) G 
a(SE(Q), SE(P)) yields (X n V, F n F) G a{SE(Q), SE(P)). By Definition 8, we get 
[X n F,F n V) G S£(P * Q). Finally, it is clear that (X,F) ^ 5^(i?), implies that 

(xnv,Ynv)$SE(R). □ 

We now proceed with the proof of Theorem 7. 

We first show membership in for the complementary problem. From Lemma 4, the 
complementary problem holds iff there exist X,Y <Z var(P U Q U R) such that (X, F) G 
SE(P * Q) and (X, Y) £ SE(R). In what follows, let V = var(P U Q U R). We first 
state the following observation: Recall that F G a(Mod(Q), Mod(P)) iff F G Mod(Q) 
and there exists a IF G Mod(P) such that IF C F and for each F' G Mod(Q) and 
IF' G Mod(P), Y' IF' £ F e IF. Now, if F C F, then there is also a IF C V 
satisfying above test (this is seen by the arguments used in the proof of Lemma 2). A 
similar observation holds for (X, Y) G a{SE(Q), SE{P)). 

Thus an algorithm to decide P * Q ^ s R is as follows. We guess interpretations 
X,Y,W,U,Z C V and start with checking (X,Y) e SE(Q) and (X,Y) £ SE(R). 
Then, we check whether SE(P) = which can be done via a single call to an NP- 
oracle. If the answer is yes, we already have found an SE interpretation (X, F) such that 
(X, Y) G SE(P * Q) and (X, Y) £ SE(R) and thus the complementary problem holds. 
If the answer is no, we next check whether (U, Z) G SE(P) and IF G Mod(P). Then, 
(i) given F and IF, we check whether for each F' C V and each IF' C V such that 
F' G Mod(Q) and IF' G Mod(P), Y' Q W <£ Y Q W holds. It is easy to see that 
then the same relation holds for arbitrary models F' and IF'. From that we can conclude 
that F G a(Mod(Q), Mod(Pj). Next, (ii) given (X,Y) and (U, Z), we check whether 
for each X' C F' C V and each U' C Z' C F such that (X',F') G SS(Q) and 
([/', IF') G S£(P), (X', F') e ({/', IF') ^ (X, F) e ([/, IF). Again, it is easy to see that 
in this case (X,Y) G a(SE(Q), SE(P)) follows. But then we obtain (X, F) G SE(P*Q) 
by Definition 8 which together with (X, F) ^ SE(R) solves the complementary problem 
in view of Lemma 4. 
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We recall that model checking as well as SE model checking are in P. So most of 
the checks used above are in P (expect the already mentioned call to an NP-oracle) and 
it remains to settle the complexity of the checks (i) and (ii). As well, they can be done 
by an NP-oracle. This can be seen by considering the respective complementary prob- 
lems, where one guesses the sets Y', W (resp., X', Y 1 , U', Z') and then performs model 
checking or SE model checking together with some other simple tests which are all in P. 
Thus, the overall algorithm runs in nondeterministic polynomial time with access to an 
NP-oracle. This shows the E^-membership as desired. 

As for the hardness-part, we use a reduction from the problem of checking whether 
a given quantified Boolean formula of form $ = VYBXtp, where <p is a propositional 
formula in conjunctive normal form over atoms X UY, evaluates to true, which is In- 
complete. For $ as described, let, for each z G X U Y, z' be a new atom. Additionally, 
for each clause c = z\ V • • • V Zk V ^Zk+i V • • • V -iz m in ip, let c be the sequence 
z[, . . . , z' k , Zfc+i, . . . , z m . Finally, let w be a further new atom and V = X UY \J {z' \ z £ 
X UY}U {w}. We define the following programs: Pj, = {v <— | v G V}, P$ = {w <— }, 
and 

Qs> = {y <- ~y'; v *- J- <- y, v I y e y} u 

{x <— ~a;', w; x' w; w <— x; w <— x'; 

±^x,x' \ xex}u 

{l^c,w|ca clause in ip}. 

The SE models over V of these programs are as follows (for a set Z of atoms, Z' stands 
for {z' | z e Z}): 

SE{P„) = {(V,V)}; 

SE(Q<s>) = {(S, S) | S = I U (Y \ I)', Jcrju 
{(S,T), (T, T) \S = IU(Y\I)', 
T = {w} U S U J U (X \ J)', 

Kr,jci,/uJhrf; 

£E(ii*) = {(Wi,W 2 ) | {w} C VKi C VK 2 C V}. 

We show that $ is true iff P$ * Q,j, \= s i?$ holds. 

Only- if direction: Suppose Pj, *Q$ ^ s i?$ does not hold. By Lemma 4, there exist S C 
T C mr(P$ U U R&) = V such that (S 1 , T) G S£(P<i> * Q$) and (S 1 , T) £ SE{R^,). 
Inspecting the SE models of P$, we obtain that w ^ S. From (<?, T) G SE(P$> * 
(S 1 , T) e SE(Q*), and thus S has to be of the form J U (F \ I)' for some ICY. Recall 
that (V, V) is the only SE model of P$ over V. Hence, S — T holds, since otherwise 
(T, T) e (V, V) C {S, T) e (V, V), which is in contradiction to (S, T) G S£(Pj> * Q$). 
Now we observe that for each 17 with 5 = T C C V, (U, U) £ SE(Q$) has to hold, 
(otherwise (U, U) Q (V, V) c (S, S) 9 (V, V)). Inspecting the SE models of SE{Q 9 ), 
this only holds if, for each J C X, I U J ^= tp. But then $ is false. 

If direction: Suppose $ is false. Then, there exists an I C Y such that for all J C X, 
/UJ^.We know that (S, S) = (I U (Y \ /)', I U (Y \ /)') G SE(Q$) and (V, V) G 
SE(P&). Next, to obtain (5, 5) G S£(P* * Q*), we show S G cr(Morf(g$), Mod(P*)). 
Suppose this is not the case. Since ScF and V is the minimal model of P$, there has 



ACM Transactions on Computational Logic, Vol. V, No. N, Month 20YY. 



40 • James Delgrande et al. 



to exist an U with S C U C V such that U G Mod(Q<s,). Recall that 5 = I U (F \ /)' 
and, by assumption, for all J C X, I U J ^= <p. By inspecting the SE models of Q$, it 
is clear that no such U G Mod(Q$,) exists. By essentially the same arguments, (S, S) G 
a(SE(Q$), SP(P$)) can be shown. Therefore, (S, S) G SE(P$ * Q$) and since w £ S, 
P$ * Q* \=s R<s> does not hold. 

This shows -hardness for normal programs Q. The result for positive programs Q 
is obtained by replacing in Q$ rules y <— y' ^— ^y by y; y' <— , and likewise rules 
x <— ~x',w and a;' <— ^x,w by x; x' <— w. Due to the presence of the constraints 
_L <— y,y' and _L <— x,x', this modification does not change the SE models of these 
programs. 

A.8 Proof of Theorem 9 

The definitions for arbitration and basic merging (Definitions 13 and 15) are essentially 
composed of two parts (as are the definitions for revision): there is a phrase to deal with 
classical propositional models (or SE models of form (Y, Y)) and then general SE models. 
For brevity, and because the case for propositional models follows immediately from the 
case of general SE models, we consider general SE models in the proofs here. 

(LSI') - (LST). These all follow trivially or straightforwardly from the definition of 

P 1 oP 2 . 

(LS8'). Assume that Pi and P 2 are satisfiable. It follows that SE((P 1 ,P 2 )) ^ and 
so Mm a (SE((P 1 ,P 2 ))) ^ 0. Let (Si,S 2 > G Min a (SE((P u P 2 »), and so Si, S 2 G 
SE(P 1 o P 2 ). Since Si G SE(P X ) we get that Si G SB (Pi) n SE(P 1 o P 2 ) and so 
Si G SE(P 1 n (Pi o P 2 )). Thus, Pi n (Pi o P 2 ) is satisfiable. 

A.9 Proof of Theorem 1 

Let <J/ be a belief profile, Po a program representing global constraints, and A as given in 
Definition 15. Then, A satisfies the following versions of the postulates of Definition 5: 

(ICO') - (IC3'), (IC9'). These follow trivially or straightforwardly from the defini- 
tion of A((P ,*)). 

(ICA'). Assume that Pi K Pi and P 2 K Pi- If SE(P 1 ) n SE(P 2 ) ^ then by 
(IC2') we have that A((P , Pi, P 2 }) = P n Pi n P 2 from which our result follows 
immediately. 

Consequently, assume that SE(P\) D SE(P 2 ) = 0. As well, assume the antecedent 
condition of the postulate that A((P , Pi, P 2 }) n Pi is satisfiable. Let * = (P , Pi, P 2 ). 
Thus, we have for some (X,Y) that (X,Y) G S£(A(*)nPi), and so (X,Y) G SP(P )n 
SP(Pi), where (X,Y) G Mm b (SE(^)) . 

_ (X,Y) G Min b (SE(ty)) implies that there is some (X',Y') G SE(P 2 ) such that 
S=((X,Y),(X 2 Y),(X',Y')) G Min b (SE(*)). 

We claim that s' = ((X', Y'), (X, Y), (X', Y')) e Min b (SE (*)). This is sufficient to 
prove our result, since s' G Min b (SE(^)) yields that (X',Y') G A(*) and (X',Y') G 
SE(P 2 ), that is to say, A(*) n P 2 is satisfiable. 

Proof o_f claim: Since S G Min b (SE '(*)), this means that for every T G SP(*) we 
have that T £ 6 S implies that S < fc T. 

Consider T = ((U , V Q ), (U u Vi), (U 2 , V 2 )). UT< b S then we have that (U , Vo) Q 
(UuVi) C (X,Y) e (X,y) = (0,0). That is, U = U x and V = V u and so T = 
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{(Uo,V ), (t/ , V ), (U 2 , V 2 J). As_well, from T < ± S, we get that (U , V ) 9 {U 2 , V 2 ) C 
(X, Y) e (X', Y'). Since T < b S implies S < b T, this means that (X, Y) 9 (X', Y') C 

(f/o,^ )e([/ 2 ,y 2 ). 

We will use this later, and so summarise the result here: 

(a) (X,Y) and (X',Y') are such that for every {U ,V ) G SE(Pi) and (U 2 ,V 2 ) G 

se(p 2 ) if (u ,v ) e (£/ 2 ,y 2 ) c (x,y) e (x',y') then (x,y) e (x',r) c 
(t/ ,y )e(c/ 2: y 2 ). 

We must show for S' = ({X',Y'), (X,Y), (X',Y')), that T < b S' implies s' < b T. 
Let T = ((U^, y '), {U[,V{), (U 2 , y 2 ')) and assume that T < 6 5'. Then, by definition 
of < 6) we have that (U^VJ) 9 (?7{, V{) C (X',Y') e (X,Y). As well, we have that 
(^o, Vq) G (t/ 2 , y 2 ) C (X', y') 9_(X', y') = (0, 0). Hence, we must have that ^ = U' 2 
and Y ' - y 2 '. Thus, we_can write T = ((U^ Vfi, (U[, V{), (U^ V ')). 

Now, we will have S' < b T just if (X',Y') 9 (X,Y) C (C/^,y o ') 9 T^') and 
(X', y') 9 (X 1 , Y 1 ) C ([^, y ') 9 (C/ 2 , y 2 ')- The second condition is vacuously true. As 
for the first condition, we have that V£) G SE(P 2 ) and (U[ , V{) G SB (Pi). Thus, via 
(a), we obtain that (X', Y') 9 (X, Y) C (U[ , V{) 9 (C/J, Vfi. We conclude that s' < 6 T. 

This shows that S' G Mzn b (SS(*)), where (X',Y') G SE(P Q ) and (X',Y') G 
SE(P 2 ). Consequently, SE(A((P , P u P 2 )) n P 2 ) is satisfiable. 

(JC5'). Consider (X,Y) G S£(A((P , *)) n A((P ,*'»). and so ( x > y ) e 
SE(A«P ,*») and (X,Y) G SE(A((P , *')))■ Thus > e Min b {SE((P ,*))) 

and (X,Y) G Min b {SE((P , #'))). Hence, there is some ((X,Y),S) G £E((P ,tf)) 
and some ((X,Y),S"') G SE((P , *')) such that <(*,^),S) < 6 T for every T G 
5B((P ,*» and ((X,Y),S) < b t' for every t' G SE((P , *'))■ But this implies 
that ((X,Y),S,S') < b ((X,Y),T") for every T" G S£((P , *, *')). Consequently, 
(X,Y) e SE(A((P ,V o *'))). 

[ICT). If A((P , #)) n Pi is unsatisfiable then the result is immediate. 

So, assume that A((P , *)) nPi is satisfiable, and let (X, Y) G S£ , (A((P , *)) nPi). 
That is, (X,Y) G SE(A((P , *))) and (X,Y) G SE(Pi). By definition we have that 
(X,Y) G Min b (SE((P ,^))) . Clearly, since (X,Y) G S£ (Pi) we also obtain that 
(X,Y) G Mm 6 (S^((P nP 1 ,*))) , from which we get {X,Y) G S£ , (A((P nPi, *))). 

A. 1 Proof of Theorem 1 1 

We first prove a helpful lemma. 

LEMMA 5. Let <3> be a belief profile. IfX~ G Min a {SE(^)) then for X t eX~we have 
(X h X) G Mm b (SE((Q,*))). 

Proof. Let * be a belief profile, and let X G Min a (SE($>)). Hence, for every Y G 
SE($>) we have that Y < a X implies X < a Y. Now, Y < a X means that y 9 Yj C 
Xj 9 Xj for every 1 < i, j < |*|. 

So, for fixed i we have that y 9 ^ C Xj 9 ^ implies that X { 9 ^ C y 9 Y, . 
Let X = Xi for that i. Thus, substituting we get that Yi QYj C X 9 Xj implies that 
loe^CFiG^. 

But this means that (X , X) G Mm b (SE((%, *))). □ 

For the proof of the theorem, we have: 
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Let X e_SB(V(*)). Then, X E \J Mm a (SE (■$)); that is, there is some X_such 
that X G ~X and ~X G Min a (SE (*)). But by Lemma 5 we then have that G 

Min b (SE((<D, *»). Hence, X G Min b (SE((<fi, *)) ) and sole SE(A«0, *))). 

A. 1 1 Proof of Theorem 1 2 

These results follow directly from the appropriate definitions. 
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